Large language model assisted cybersecurity platform

Patent metadata

Field	Value
Publication number	US-2025036773-A1
Application number	US-202418425973-A
Country	US
Kind code	A1
Filing date	Jan 29, 2024
Priority date	Jul 25, 2023
Publication date	Jan 30, 2025
Grant date	—

Abstract

A system and method of using generative AI to convert NL queries to database commands for accessing one or more databases. The method includes receiving a natural language (NL) request for information associated with a private network. The method includes providing the NL request to an artificial intelligence (AI) model trained to identify, from a plurality of access objects associated with a plurality of databases and a plurality of event types, a particular access object that provides access to one or more event datasets associated with the NL request. The method includes generating, by a processing device and using the AI model, a database request associated with the particular access object based on the NL request.

First claim

What is claimed is:

1 . A method comprising:
receiving a natural language (NL) request for information associated with a private network; providing the NL request to an artificial intelligence (AI) model trained to identify, from a plurality of access objects associated with a plurality of databases and a plurality of event types, a particular access object that provides access to one or more event datasets associated with the NL request; and generating, by a processing device and using the AI model, a database request associated with the particular access object based on the NL request.

2 . The method of claim 1 , further comprising:
collecting the plurality of event datasets from a plurality of endpoint devices of the private network; and indexing the plurality of event datasets into the plurality of databases based on the plurality of event types.

3 . The method of claim 2 , wherein indexing the plurality of event datasets into the plurality of databases based on the plurality of event types comprises:
determining that a first dataset of the plurality of event datasets is indicative of a first event type of the plurality of event types; determining that a second dataset of the plurality of event datasets is indicative of a second event type of the plurality of event types; and storing the first dataset in a first database of the plurality of databases and the second dataset in a second database of the plurality of databases.

4 . The method of claim 2 , further comprising:
generating, using a first access object of the plurality of access objects, a first schema that indicates a first dataset stored in a first database of the plurality of databases, the first dataset is associated with a first event type; and generating, using a second access object of the plurality of access objects, a second schema that indicates a second dataset stored in a second database of the plurality of databases, the second dataset is associated with a second event type.

5 . The method of claim 2 , further comprising:
generating mapping data that indicates a relationship between the plurality of databases and the plurality of access objects, wherein generating the database request associated with the particular access object is further based on the mapping data.

6 . The method of claim 1 , further comprising:
converting the NL request to the database request associated with the particular access object.

7 . The method of claim 1 , further comprising:
providing, to an endpoint device, access to the one or more event datasets based on the database request.

8 . The method of claim 1 , wherein the plurality of event types is indicative of at least one of detection data, vulnerability data, or threat data.

9 . The method of claim 1 , wherein the NL request is for one or more of the following:
an identifier of one or more threat actors associated with a particular industry; a factor indicating a degree of exposure that a particular computing device has to a particular threat type; or an identifier of one or more hosts with a particular installed application.

10 . The method of claim 1 , wherein the database request is a structured query language (SQL) request.

11 . A system comprising:
a memory; and a processing device, operatively coupled to the memory, to:
receive a natural language (NL) request for information associated with a private network;
provide the NL request to an artificial intelligence (AI) model trained to identify, from a plurality of access objects associated with a plurality of databases and a plurality of event types, a particular access object that provides access to one or more event datasets associated with the NL request; and
generate, using the AI model, a database request associated with the particular access object based on the NL request.

12 . The system of claim 11 , wherein the processing device is further to:
collect the plurality of event datasets from a plurality of endpoint devices of the private network; and index the plurality of event datasets into the plurality of databases based on the plurality of event types.

13 . The system of claim 12 , wherein to index the plurality of event datasets into the plurality of databases based on the plurality of event types, the processing device is further to:
determine that a first dataset of the plurality of event datasets is indicative of a first event type of the plurality of event types; determine that a second dataset of the plurality of event datasets is indicative of a second event type of the plurality of event types; and store the first dataset in a first database of the plurality of databases and the second dataset in a second database of the plurality of databases.

14 . The system of claim 12 , wherein the processing device is further to:
generate, using a first access object of the plurality of access objects, a first schema that indicates a first dataset stored in a first database of the plurality of databases, the first dataset is associated with a first event type; and generate, using a second access object of the plurality of access objects, a second schema that indicates a second dataset stored in a second database of the plurality of databases, the second dataset is associated with a second event type.

15 . The system of claim 12 , wherein the processing device is further to:
generate mapping data that indicates a relationship between the plurality of databases and the plurality of access objects, wherein to generate the database request associated with the particular access object is further based on the mapping data.

16 . The system of claim 11 , wherein the processing device is further to:
convert the NL request to the database request associated with the particular access object.

17 . The system of claim 11 , wherein the processing device is further to:
provide, to an endpoint device, access to the one or more event datasets based on the database request.

18 . The system of claim 11 , wherein the plurality of event types is indicative of at least one of detection data, vulnerability data, or threat data.

19 . The system of claim 11 , wherein the NL request is for one or more of the following:
an identifier of one or more threat actors associated with a particular industry; a factor indicating a degree of exposure that a particular computing device has to a particular threat type; or an identifier of one or more hosts with a particular installed application.

20 . A non-transitory computer-readable medium storing instructions that, when execute by a processing device, cause the processing device to:
receive a natural language (NL) request for information associated with a private network; provide the NL request to an artificial intelligence (AI) model trained to identify, from a plurality of access objects associated with a plurality of databases and a plurality of event types, a particular access object that provides access to one or more event datasets associated with the NL request; and generate, by the processing device and using the AI model, a database request associated with the particular access object based on the NL request.

Assignees

• Crowdstrike Inc

Inventors

• Chihaia Theo
• Radu Daniel
• Cojocaru Adrian-Cosmin

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F16/22

  Indexing; Data structures therefor; Storage structures · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F16/24522 Primary

  Translation of natural language queries to structured queries · CPC title