Cloud Security Podcast by Google EP213 From Promise to Practice: LLMs for Anomaly Detection and Real-World Cloud Security
12 snips
Mar 3, 2025 Yigael Berger, Head of AI at Sweet Security, shares insights into the application of large language models (LLMs) for cloud security. He discusses the gap between LLMs' potential and their real-world effectiveness, especially in anomaly detection. Berger explains how LLMs analyze event sequences to enhance accuracy while managing noise. He also addresses the challenges SOC teams face with false positives and negatives, emphasizing the psychological barriers to embracing AI in security. Ultimately, he posits that LLMs may tip the balance in favor of defenders in the cybersecurity battle.
AI Snips
Chapters
Transcript
Episode notes
LLMs in Security: Beyond Surface-Level Applications
- Many vendors quickly implemented LLM-powered features, but only superficially.
- Integrating LLMs deeper into the decision-making process yields significantly better results.
LLMs for Anomaly Detection: A Novel Application
- LLMs can be used for anomaly detection, which is a novel application beyond text summarization.
- Sweet Security uses LLMs for anomaly detection in cloud environments.
LLM-based Anomaly Detection: A "Neat Trick"
- LLMs can perform anomaly detection by probing their "memory" to assess sentence probability.
- Training an LLM on cloud log data allows it to detect anomalous sequences of events, similar to recognizing unusual sentences like "once upon a clock."