-
Notifications
You must be signed in to change notification settings - Fork 0
Matthew Swift Personal Research
What does the paper present?
The paper presents a new metric for measuring the chance that a CWE will get exploited within 30 days in the wild. This new metric is called PECWE and it takes in a CVE and a date and outputs a percentage chance of it being exploited.
What is the problem that it is addressing?
The problem that it is addressing is the lack of measurement for exploitation of a CWE in the wild within 30 days of a date.
Who is the audience?
The security community is the main audience because awareness of this is important to be able to craft solutions that are secure and fight against these weaknesses.
What is the finding?
The finding is a complementary equation to something like CVE frequency. Although CVE frequency can indicate exploitation, it doesn't necessarily mean that it is being taken advantage of. However, PECWE and CVE frequency are highly correlated.
What does the paper present?
The paper is a survey of how LLMs are being applied in cybersecurity. It looks at different research for different use cases like penetration testing, vulnerability detection, phishing, etc.
What is the problem that it is addressing?
The problem is that there are two main gaps. The first is that LLMs have blown up in research but their application to cybersecurity is lagging behind. The second is that the LLM-based cybersecurity tools that already exist are not very good. They can't really handle large context-windows, they hallucinate, and they fail to complete large, multi-step tasks.
Who is the audience?
The audience are cybersecurity/LLM researchers.
What is the finding?
The main finding is that LLMs in cybersecurity can be really good. They help with a lot of different tasks but still struggle like I mentioned above. One of the main solutions was using a MoE (mixture-of-experts) approach where you have different LLMs that are specialized for different tasks work together to complete a larger problem. This sounds to me something like agentic AI.