IRonMAN: InterpRetable Incident Inspector Based ON Large-Scale Language Model and Association miNing
summary
System combines CMD GPT embedding with a traditional association-mining filter to surface human-readable “significant tokens” by measuring embedding similarity drop when a token is removed. A learned minifold tokenizer splits messy command lines into meaningful tokens (about 20% F1 gain over space splitting). Deploys on a global visibility feed of 200M+ events per day; evaluated on a 5,000‑endpoint red team over three weeks where 257 malicious commands are labeled, 8 are missed, and across 7.3M commands the system flags 291 with 42 false positives.
AI-written summary · about
chapters (11)
- 0:00IRonMAN research team
- 4:07Cybersecurity motivation
- 8:46Command line analysis challenges
- 15:34CMD GPT and command embedding
- 18:02CMD GPT limitations
- 21:17IRonMAN system design
- 23:22Significant token mining methodology
- 27:59Significant token mining example
- 31:09Experimental results
- 36:58Live demo
- 38:25Key takeaways
related talks
19mLarge Language Models for Automatic Cloud Incident Management
40mApplying Artificial Intelligence to the Incident Response Function
26mCommand line language – where NLP and cyber security meets
28mSupercharging Threat Intelligence with AI
13mIntegrating Large Language Models into Security Incident Response
01h 07mEmpowering Security Teams with Generative AI
38mNext-Gen Detection: Harnessing LLMs for Sigma Rule Automation
30mProcessing Threat Reports at Scale Using AI and ML: Expectations and Reality