The Marriage of AI and Cybersecurity — From Network Detection to SOC Automation

Introduction: A New Philosophy for Cyber Defense

Vectra AI is a pioneer in applying Artificial Intelligence (AI) to cybersecurity with a core philosophy: effective cyber defense requires tight collaboration between security researchers and data scientists.

Their goal is to move beyond:

• reactive, signature-based security
• brittle, easily-evaded anomaly rules

…and instead design generalizable models that capture attacker behavior at an abstract level.

This document outlines:

1. how data representation shapes detection performance
2. how large language models reshape SOC workflows
3. how Vectra AI blends symbolic reasoning + LLMs to work toward SOC automation

The success of any ML system depends heavily on:

• how data is represented, and
• which model architecture is chosen

Linear Models + Domain Expertise

• Data scientists alone may not solve a complex security problem with a simple model.
• Security researchers alone may create fragile signatures.
• Vectra's solution: researchers guide data scientists to transform raw data so that simple linear models can cleanly separate malicious from benign traffic.

Modeling Time in Security

Certain threat behaviors are inherently temporal (e.g., network flows).

Traditional approach:

• Random Forest with handcrafted features
• Failed for advanced C2 detection

Breakthrough: RNNs

RNNs model multi-dimensional time series and detect abstract attacker behavior patterns.

C2 Example:

Attackers often:

• reverse normal communication flow
• create unseen C2 tools

RNNs generalized to completely new C2 frameworks years after initial training.

Privilege anomaly = user's observed privilege differs from intended privilege.

Solution:

• Build graph of users, hosts, services
• Compute observed privilege (PageRank-like)
• Flag deviations

Useful for:

• lateral movement
• privilege escalation
• BloodHound-style mapping attacks

LLMs excel at:

• fast
• intuitive
• pattern-based reasoning

But struggle with:

• logical
• deliberate
• multi-step reasoning

Example hallucination: "Miami, Florida has state income tax." (incorrect)

1. Specification Issues
Poor design or unclear requirements.

2. Inter-Agent Misalignment
Agents misinterpret each other.

3. Task Verification Failures
Outputs go unvalidated (e.g., invalid IP treated as valid).

1. Chain-of-Thought Prompting
Ask LLM to show steps before the answer.

2. Self-Reflection Agents
Verifier checks generator output.

3. Multi-Agent Systems
Planning agent, execution agents, verification agents.

• Natural language → SQL
• Automated incident summaries
• TL;DR for long logs or email threads
• Normalization of messy external data (e.g., LinkedIn job titles)

LLMs handle fuzzy unstructured tasks.
Symbolic systems handle deterministic logic.

Structured Outputs:
All agent output must be JSON-structured and validated.

Adversarial Awareness:
LLMs are given both supporting and contradicting evidence to improve reasoning.

Analysts over-trusted LLM outputs.

Add speed bumps and flags requiring human review.

• Big productivity boost
• AI behaves like "extra analysts"
• Full automation still far out due to risk of errors

To succeed with AI in cybersecurity:

1. Try classical methods first
2. Introduce AI when traditional approaches fail
3. Combine LLMs with symbolic reasoning
4. Prioritize reliability
5. Structure and verify all agent outputs

The future of SOC is not replacing analysts — it is amplifying them.