101 citations · 102 across the 5 of their papers we have counts for
6 papers
From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage
Saimon Amanuel Tsegai, Alex Kantchelian, Danfeng +2
Security operations centers (SOCs) must triage large volumes of alerts, most of which are benign, while missed attacks can remain uninvestigated. Tool-using large language model (L…
Benchmarking and Exploring the Capabilities of LLMs for Attack Investigations
Aniket Anand, Yiwei Hou, Daniel Fields +4
This paper presents AuditBench, a new benchmark dataset for evaluating the capabilities of LLMs at investigating security-related system audit logs. We design and use this benchmar…
Facade: High-Precision Insider Threat Detection Using Deep Contextual Anomaly Detection
Alex Kantchelian, Casper Neo, Ryan Stevens +10
Insiders with privileged access have the power to cause great harm to their organization. Even a single insider threat incident can be catastrophic, resulting in both financial los…
Fine Grained Insider Risk Detection
Birkett Huber, Casper Neo, Keiran Sampson +3
We present a method to detect departures from business-justified workflows among support agents. Our goal is to assist auditors in identifying agent actions that cannot be explaine…
Reviewer Integration and Performance Measurement for Malware Detection
Brad Miller, Alex Kantchelian, Michael Carl Tschantz +9
We present and evaluate a large-scale malware detection system integrating machine learning with expert reviewers, treating reviewers as a limited labeling resource. We demonstrate…
Evasion and Hardening of Tree Ensemble Classifiers
Alex Kantchelian, J. D. Tygar, Anthony D. Joseph
Classifier evasion consists in finding for a given instance the nearest instance such that the classifier predictions of and are different. We present two novel a…