IntellBot: Retrieval Augmented LLM Chatbot for Cyber Threat Knowledge Delivery

TL;DR

IntellBot is an advanced cybersecurity chatbot leveraging large language models and retrieval-augmented generation to provide accurate, context-aware threat intelligence and improve incident response capabilities.

Contribution

The paper introduces IntellBot, a novel cybersecurity chatbot that combines LLMs with retrieval-augmented techniques for comprehensive threat knowledge delivery.

Findings

BERT score above 0.8 indicating high accuracy

Cosine similarity scores from 0.8 to 1 demonstrating relevance

Evaluation metrics above 0.77 confirming system efficacy

Abstract

In the rapidly evolving landscape of cyber security, intelligent chatbots are gaining prominence. Artificial Intelligence, Machine Learning, and Natural Language Processing empower these chatbots to handle user inquiries and deliver threat intelligence. This helps cyber security knowledge readily available to both professionals and the public. Traditional rule-based chatbots often lack flexibility and struggle to adapt to user interactions. In contrast, Large Language Model-based chatbots offer contextually relevant information across multiple domains and adapt to evolving conversational contexts. In this work, we develop IntellBot, an advanced cyber security Chatbot built on top of cutting-edge technologies like Large Language Models and Langchain alongside a Retrieval-Augmented Generation model to deliver superior capabilities. This chatbot gathers information from diverse data sources to create a comprehensive knowledge base covering known vulnerabilities, recent cyber attacks, and emerging threats. It delivers tailored responses, serving as a primary hub for cyber security insights. By providing instant access to relevant information and resources, this IntellBot enhances threat intelligence, incident response, and overall security posture, saving time and empowering users with knowledge of cyber security best practices. Moreover, we analyzed the performance of our copilot using a two-stage evaluation strategy. We achieved BERT score above 0.8 by indirect approach and a cosine similarity score ranging from 0.8 to 1, which affirms the accuracy of our copilot. Additionally, we utilized RAGAS to evaluate the RAG model, and all evaluation metrics consistently produced scores above 0.77, highlighting the efficacy of our system.