2 ms·
> LLMs could enable them to make the analysis more targeted and effective. How? I'm not trying to be combative, I genuinely am curious if you have an idea how
by jcgrillo 3y ago
> LLMs could enable them to make the analysis more targeted and effective.
How? I'm not trying to be combative, I genuinely am curious if you have an idea how these things could be usefully applied to that problem. In my experience working in the information security space, approximate techniques (neural nets, etc.) haven't gotten much traction. Deterministic detection rules are how we approach the problem of finding the needle in the hay pile. So if you have a concrete idea here that could represent an advancement in this field.
- pixl97 3y agoI guess my next question is how many needles do you find and how sharp are they? Detection rules would filter out most of the noise, then something like an LLM would do a post filter for intent analysis to rank relative risks for human intelligence to look at.
- jcgrillo 3y agoI suspect this would disincentivize operators to take care in the way they write their detection rules, and the nondeterminism of the LLM would then result in false negatives. So the rate of growth of the needles set would increase, and the analysts would be getting lower quality information mediated by the LLM. In a world where false negatives--i.e. failing to detect a sharp needle--are the worst possible failure mode, approximations need to be handled with exceeding care.