Investigating cybersecurity incidents using large language models in latest-generation wireless networks

Abstract: The purpose of research: Detection of cybersecurity incidents and analysis of decision support and assessment of the effectiveness of measures to counter information security threats based on modern generative models. The methods of research: Emulation of signal propagation data in MIMO systems, synthesis of adversarial examples, execution of adversarial attacks on machine learning models, fine tuning of LLMs for detecting adversarial attacks, explainability of decisions on detecting cybersecurity incidents based on the prompts technique. Scientific novelty: A binary classification of data poisoning attacks was performed using LLMs, and the possibility of using LLMs for investigating cybersecurity incidents in the latest generation wireless networks was investigated. The result of research: Fine-tuning of LLMs was performed on the prepared data of the emulated wireless network segment. Six LLMs were compared for detecting adversarial attacks, and the capabilities of explaining decisions made by a LLM were investigated. The Gemma-7b model showed the best results according to the metrics Precision = 0.89, Recall = 0.89 and F1-Score = 0.89. Based on various explainability prompts, the Gemma-7b model notes inconsistencies in the compromised data under study, performs feature importance analysis and provides various recommendations for mitigating the consequences of adversarial attacks. LLMs integrated with binary classifiers of network threats have significant potential for practical application in the field of cybersecurity incident investigation, decision support and assessing the effectiveness of measures to counter information security threats.