CIBERIA project’s cybersecurity research presented at the ARES Conference

Cybersecurity research activities, promoted by the members of the CIBERIA project and supported by AIR Institute partners, are presented at scientific and dissemination events, such as the ARES Conference, which was held between 30 July and 2 August in Vienna, Austria.
From among the members of CIBERIA, a group of researchers from the Universidade da Beira Interior in Portugal participated in this event, which presented an article on the "Analysis of the Capability and Training of Chats Bots in the Generation of Rules for Firewall or Intrusion Detection Systems". This paper focuses on exploring Large Language Models (AI models trained on large amounts of data that are able to understand and generate natural language) like ChatGPT.

This type of tools shows some potential for bridging the knowledge gap in various technical areas, such as cybersecurity, by providing, in this particular case, a way to convert instructions written in natural language into specialised instructions for software systems, such as firewall rules.
This study analyses the capability of the chatbots that are currently being used for the generation of rules for firewalls and intrusion detection systems. This preliminary evaluation, conducted manually due to the various possible solutions for the same attack, revealed that the available chatbots have a limited ability to generate correct and efficient rules, and stressed the importance of caution when using their output for the aforementioned purpose.
To overcome this limitation, three different tuning approaches (the process of adapting a pre-trained model to a specific task) were explored, each with a different goal and different success rates. These approaches showed a significant improvement compared to the base model on which the fine-tuning was performed (success rate of 4%) and demonstrated that this is a viable way to developing a specialised model against cyber-attacks.

Proyecto CIBERIA

The project "CIBERIA - Digitalisation and cross-border resilience through the promotion of a cybersecure CENCYL area" focuses on promoting economic growth and the development of new solutions in the digital field, accompanied by 11 partners from Castile and León and Central Portugal: University of Salamanca (USAL), University of León (ULE), the CIDAUT Foundation, the Scientific Park of the University of Salamanca, the Artificial Intelligence Centre (AIR INSTITUTE), the Supercomputing Centre of Castilla y León (SCAYLE), the University of Biera Interior (UBI), the Guarda Polytechnic Institute, the Intermunicipal community of Bieras and Sierra da Estrela (CIM-BSE) and Secure Networks, IT consultancy.