Malware detection using generative artificial intelligence and threat knowledge database

Abstract

Cyber security events are detected at modules on a vehicle and are passed to a cyber security platform. A generative AI model generates a natural language summary of each event and then groups these events based upon the natural language summaries. The model produces a natural language summary for each group. Groups are linked together based upon their natural language summaries and the model produces a natural language summary for each set of linked groups. The model attempts to match the summary of each set of linked groups to incident cases in a threat knowledge database; a match generates an incident alert. A partial match generates an early warning indicating which group of events is not present in the set of linked groups. No matching to any incident alert may also occur in which case no alert is output thus reducing false positives. The AI model uses retrieval augmented generation.