|
1.1 Introduction to AI and Machine Learning in Cybersecurity
- Overview of AI concepts and their real-world applications in threat detection and prevention.
- Differences between LLMs (GPT, LLaMA, Claude, DeepSeek) and their cybersecurity implications.
- Learning Objective: Understand core AI concepts, LLM capabilities, and their relevance to SOC operations.
|
| Module 1 Foundations of AI & LLMs for Cybersecurity |
1.2 Understanding LLMs (Large Language Models)
- Architecture and mechanisms of LLMs: transformers, self-attention, fine-tuning.
- Local Deployment: Setting up LLMs locally using LLMStudio and Pinokio.
- Cloud Deployment: Utilizing OpenAI, Anthropic, HuggingFace for security analysis.
- Key Tools: langchain, llama.cpp, transformers.
- Hands-On Lab: Deploy a local LLM and perform a security-focused prompt (e.g., summarizing a malware report).
- Lab Setup:
- Requirements: Python, Docker, LLMStudio.
- Tasks:
- Install dependencies and configure LLMStudio.
- Deploy an LLM locally and generate a malware analysis summary.
- Compare results with cloud-based models.
|
|
1.3 Common Issues and Limitations
- Hallucinations: Why LLMs generate false information and how to mitigate it.
- Security implications of model misuse and ethical considerations.
- Learning Objective: Recognize LLM limitations and apply best practices to mitigate risk.
|
| Module 2 AI for Cybersecurity vs. Cybersecurity for AI |
2.1 Securing AI Systems
- Attack vectors: prompt injection, model evasion, data poisoning, and model theft.
- OWASP Top 10 for LLMs and MITRE ATLAS for AI threats.
- Open-source tools for red-teaming AI: Garak, Giskard, AdvBench.
- Hands-On Lab:
- Perform a red-team exercise: attempt prompt injection on a local LLM.
- Generate SIEM queries and parse logs using ChatGPT and LLMStudio.
- Lab Setup:
- Requirements: Local LLM, Python scripts for log parsing.
- Tasks:
- Deploy a vulnerable LLM instance.
- Test prompt injection techniques and observe outcomes.
- Write SIEM query prompts and analyze results.
|
|
2.2 Applying AI for Security Operations
- AI for CISO decision support, IR automation, and pentesting.
- Basics and advanced techniques in Prompt Engineering.
- Prompting for log analysis, malware triage, and policy drafting.
- Learning Objective: Understand how AI augments decision-making and incident response in SOC operations.
|
|
3.1 Offensive AI Techniques
- Deepfakes and voice cloning for social engineering.
- AI-generated phishing attacks (DarkWebGPT, WormGPT).
- Malware development assistance using CodeGen and AI.
|
| Module 3 Threat Actor Use of AI |
3.2 Real-World Scenarios and Labs
- Simulating a phishing attack with AI-generated emails.
- Crafting malware templates using LLMs (in a controlled environment).
- Analyzing AI-generated disinformation campaigns.
|
|
Hands-On Lab:
- Use DeepFaceLab to understand deepfake creation and detection.
- Generate a phishing email with WormGPT simulation.
- Lab Setup:
- Requirements: DeepFaceLab, WormGPT.
- Tasks:
- Clone a voice and generate a fake call.
- Craft a phishing email template using AI.
|
|
4.1 Practical AI Applications in SOC
- Phishing Triage & IOC Extraction.
- Automated Windows/Linux log parsing.
- EDR telemetry analysis.
- DDoS attack insights using AI for tcpdump analysis.
- Playbook generation for Incident Response.
|
| Module 4 Advanced SOC & IR Use Cases |
4.2 Extended Use Cases
- Scenario creation for Tabletop Exercises.
- SOC Playbook automation with AI.
- Interview question generation for new SOC hires.
- Creating onboarding plans and incident response templates.
|
|
Hands-On Lab:
- Prompt an AI to generate an IR Playbook for a ransomware incident.
- Parse Windows Event Logs using AI for anomaly detection.
|
|
5.1 Threat Intelligence with AI
- Using LLMs for threat actor profiling and TTP mapping.
- Campaign clustering and dark web monitoring automation.
|
| Module 5 Threat Actor Use of AI |
5.2 Compliance Monitoring and Reporting
- AI-driven compliance mapping (NIST, ISO 27001, GDPR).
- Drafting policies with AI assistance.
|
|
5.3 Building AI Agents & Automated Workflows
- Introduction to Agentic AI: Tracecat, n8n, CrewAI.
- Multi-agent workflows for SOC operations.
|