{"id":642486,"date":"2023-04-28T10:06:24","date_gmt":"2023-04-28T15:06:24","guid":{"rendered":"https:\/\/news.sellorbuyhomefast.com\/index.php\/2023\/04\/28\/tenable-opens-playground-for-generative-ai-cyber-tools\/"},"modified":"2023-04-28T10:06:24","modified_gmt":"2023-04-28T15:06:24","slug":"tenable-opens-playground-for-generative-ai-cyber-tools","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2023\/04\/28\/tenable-opens-playground-for-generative-ai-cyber-tools\/","title":{"rendered":"Tenable opens playground for generative AI cyber tools"},"content":{"rendered":"<div id=\"content-header\">\n<h2>A set of generative AI cyber tools designed to help security researchers in reverse engineering, debugging and other areas of work have been made available for the community to experiment with<\/h2>\n<\/div>\n<div id=\"content-center\">\n<ul>\n<li><i data-icon=\"1\"><\/i><\/li>\n<li><i data-icon=\"2\"><\/i><\/li>\n<\/ul>\n<div id=\"contributors-block\">\n<p><img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/rms\/computerweekly\/Alex-Scroxton-CW-Contributor-2022.jpg\" alt=\"Alex Scroxton\">\n\t\t\t\t\t<\/p>\n<p><span>By<\/span><\/p>\n<ul>\n<li>\n\t\t\t\t\t<a href=\"https:\/\/www.techtarget.com\/contributor\/Alex-Scroxton\">Alex Scroxton,<\/a><br \/>\n\t\t\t\t\t\t<span>Security Editor<\/span>\n\t\t\t\t\t\t<\/li>\n<\/ul>\n<p>\n\tPublished: <span>27 Apr 2023 16:15<\/span>\n<\/p>\n<\/div>\n<section id=\"content-body\">\n<p>The security community is being invited to explore the potential of <a href=\"https:\/\/www.techtarget.com\/searchenterpriseai\/definition\/generative-A\" target=\"_blank\" rel=\"noopener\">generative artificial intelligence<\/a> (AI) to act as a useful tool in its research efforts, with the release of a number of prototype tools developed by Tenable, which are now <a href=\"https:\/\/github.com\/tenable\/awesome-llm-cybersecurity-tools\">available to check out on Github<\/a>.<\/p>\n<p>In an accompanying report titled <i><a href=\"https:\/\/static.tenable.com\/marketing\/research-reports\/Research-Report-How_Generative_AI_Is_Changing_Security_Research.pdf\">How generative AI is changing security research<\/a><\/i>, the firm\u2019s research team shares how it has been experimenting with generative AI applications to create efficiencies in reverse engineering, code debugging, web application security and visibility into cloud-based tools.<\/p>\n<p>Tenable, which describes itself as an \u201cexposure management\u201d company, said tools such as those based on <a href=\"https:\/\/www.techtarget.com\/searchenterpriseai\/news\/365532735\/OpenAI-releases-latest-version-of-its-star-LLM-GPT-4\">OpenAI\u2019s latest generative pre-trained transformer model<\/a>, <a href=\"https:\/\/openai.com\/product\/gpt-4\">GPT-4<\/a>, potentially now have abilities on par with those of a \u201cmid-level security researcher\u201d.<\/p>\n<p>But, as Tenable director of security response and zero-day research Ray Carney explained in the report\u2019s preamble, even OpenAI admits GPT-4 has similar limitations to earlier GPT models, particularly around reliability and biases that arise as a result of the model\u2019s experiences, how it was trained, incomplete and imperfect training data, and cognitive biases among the model\u2019s developers.<\/p>\n<p>Added to this, he said, one must consider the cognitive biases of the people querying the model \u2013 asking the right questions becomes \u201cthe most critical factor\u201d in how likely one is to receive a correct answer.<\/p>\n<p>This, said Carney, relates to security researchers, because the role of such people is to offer timely and accurate data to decision-makers.<\/p>\n<p>\u201cIn pursuit of this goal, the analyst must process and interpret collections of incomplete and ambiguous data in order to produce sound, well-founded analytical judgments,\u201d he wrote. \u201cOver the course of many years, and many failures, the analytical community has developed a set of tools commonly referred to as \u2018structured analytic techniques\u2019 that help to mitigate and minimise the risk of being wrong, and avoid ill-informed decisions.<\/p>\n<p>\u201c<a href=\"https:\/\/openai.com\/research\/gpt-4\">The warnings posed by OpenAI in its announcement of GPT-4<\/a> make a strong argument for the application of these techniques,\u201d continued Carney. \u201cIn fact, it is only through the application of these types of techniques that we will ultimately produce a well-refined dataset to train future models in the cyber security domain.<\/p>\n<p>\u201cThese types of techniques will also help researchers to ensure that they are tuning their prompts for those models \u2013 that they\u2019re asking the right questions,\u201d he said. \u201cIn the meantime, security researchers can continue to investigate how we leverage generative AI capabilities for more mundane tasks in order to free up time for researchers and analysts to invest their time on the more difficult questions that require their subject matter expertise to tease out critical context.\u201d<\/p>\n<p>The first tool they came up with is called G-3PO. This tool builds on the NSA-developed <a href=\"https:\/\/ghidra-sre.org\/\">Ghidra<\/a> <a href=\"https:\/\/www.techtarget.com\/searchsoftwarequality\/definition\/reverse-engineering\">reverse engineering<\/a> framework that has become a perennial favourite among researchers since it was declassified and made widely available in the 2010s. It performs a number of crucial functions, including binary disassembly into assemble language listings, reconstructing control flow graphs and decompiling assembly listings into something that at least resembles code.<\/p>\n<p><a href=\"https:\/\/www.techtarget.com\/searchsecurity\/feature\/Get-started-with-the-Ghidra-reverse-engineering-framework\">However, to use Ghidra<\/a>, one still needs to be able to meticulously analyse the decompiled code by comparing it with the original assembly listing, adding comments, and assigning descriptive names to variables and functions.<\/p>\n<p>Here, G-3PO picks up the baton, running the decompiled code through a large language model (LLM) to gain an explanation of what the function does along with suggestions for descriptive variable names.<\/p>\n<p>Tenable said this functionality would allow an engineer to \u201cgain a rapid, high-level understanding of the code\u2019s functionality without having to first decipher every line\u201d. They can then zero in on the most concerning regions of code for deeper analysis.<\/p>\n<p>Two of the other tools, AI for Pwndbg and AI for GEF, are code <a href=\"https:\/\/www.techtarget.com\/searchsoftwarequality\/definition\/debugging\">debugging<\/a> assistants that act as plugins for two popular <a href=\"https:\/\/manpages.org\/gdb\">GNU Debugger<\/a> (GDB) extension frameworks, Pwndbg and GEF. These interactive tools receive various data points \u2013 such as registers, stack values, backtrace, assembly and decompiled code \u2013 that can help a researcher explore the debugging context. All the researcher has to do is ask it questions, such as \u201cwhat is happening here?\u201d or \u201cdoes this function look vulnerable?\u201d<\/p>\n<p>Tenable said these tools would help solve the problem of navigating the steep learning curve associated with debugging, turning GDB into a more conversational interface where researchers can essentially discuss what is happening without the need to decipher raw debugging data. The tool is by no means flawless, but it has shown promising results in reducing complexity and time, and Tenable hopes it could also be used as an educational resource.<\/p>\n<p>Other tools being made available include BurpGPT, a <a href=\"https:\/\/portswigger.net\/burp\">Burp Suite<\/a> extension that lets researchers use GPT to analyse HTTP requests and responses, and EscalateGPT, an AI-powered tool that probes for misconfigurations in identity and access management (IAM) policies <a href=\"https:\/\/www.computerweekly.com\/feature\/Why-IAM-systems-are-crucial-for-securing-multicloud-architecture\">for cloud environments<\/a>, one of the most common and overlooked concerns among enterprises, and uses GPT to identify possible escalation opportunities and mitigations.<\/p>\n<section data-menu-title=\"Silver lining\">\n<h3><i data-icon=\"1\"><\/i>Silver lining<\/h3>\n<p>Tenable said that while it was to be anticipated that threat actors will take advantage of generative AI themselves, and it was probably only a matter of time before the threat of reliable, AI-written malware is realised, there is a silver lining in that there is still \u201cample opportunity\u201d for defenders to harness generative AI, too.<\/p>\n<p>Indeed, in some regards, such as log parsing, anomaly detection, triage and incident response, they could even get the upper hand.<\/p>\n<p>\u201cWhile we\u2019re only at the start of our journey in implementing AI into tools for security research, it\u2019s clear the unique capabilities these LLMs provide will continue to have profound impacts for both attackers and defenders,\u201d wrote the research team.<\/p>\n<\/section>\n<\/section>\n<section id=\"DigDeeperSplash\">\n<h4>\n\t\t\t<i data-icon=\"m\"><\/i>Read more on Application security and coding requirements<\/h4>\n<ul>\n<li><a id=\"DigDeeperItem-1\" href=\"https:\/\/www.techtarget.com\/searchcustomerexperience\/news\/365535695\/Salesforce-brings-Einstein-GPT-to-Field-Service-Mobile\"><br \/>\n\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/rms\/onlineimages\/check_g1199056723_searchsitetablet_520X173.jpg\" srcset=\"https:\/\/cdn.ttgtmedia.com\/rms\/onlineimages\/check_g1199056723_searchsitetablet_520X173.jpg 960w,https:\/\/cdn.ttgtmedia.com\/rms\/onlineimages\/check_g1199056723.jpg 1280w\" alt ><\/p>\n<h5>Salesforce brings Einstein GPT to Field Service Mobile<\/h5>\n<div>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/rms\/onlineimages\/reines_mary.jpg\" alt=\"MaryReines\">\n\t\t\t\t\t\t\t\t\t<\/p>\n<p><span>By: <span>Mary\u00a0Reines<\/span><\/span>\n\t\t\t\t\t\t\t<\/p>\n<\/div>\n<p>\t\t\t\t<\/a><\/li>\n<li><a id=\"DigDeeperItem-2\" href=\"https:\/\/www.techtarget.com\/searchenterpriseai\/definition\/generative-AI\"><br \/>\n\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/visuals\/digdeeper\/2.jpg\" srcset=\"https:\/\/cdn.ttgtmedia.com\/visuals\/digdeeper\/2_searchsitetablet_520X173.jpg 960w,https:\/\/cdn.ttgtmedia.com\/visuals\/digdeeper\/2.jpg 1280w\" alt ><\/p>\n<h5>What is generative AI? Everything you need to know<\/h5>\n<div>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/rms\/onlineImages\/lawton_george.jpg\" alt=\"GeorgeLawton\">\n\t\t\t\t\t\t\t\t\t<\/p>\n<p><span>By: <span>George\u00a0Lawton<\/span><\/span>\n\t\t\t\t\t\t\t<\/p>\n<\/div>\n<p>\t\t\t\t<\/a><\/li>\n<li><a id=\"DigDeeperItem-3\" href=\"https:\/\/www.techtarget.com\/searchcustomerexperience\/news\/365535436\/Salesforce-integrates-Einstein-GPT-and-Data-Cloud-into-Flow\"><br \/>\n\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/rms\/onlineimages\/iot_g1204761980_searchsitetablet_520X173.jpg\" srcset=\"https:\/\/cdn.ttgtmedia.com\/rms\/onlineimages\/iot_g1204761980_searchsitetablet_520X173.jpg 960w,https:\/\/cdn.ttgtmedia.com\/rms\/onlineimages\/iot_g1204761980.jpg 1280w\" alt ><\/p>\n<h5>Salesforce integrates Einstein GPT and Data Cloud into Flow<\/h5>\n<div>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/rms\/onlineimages\/reines_mary.jpg\" alt=\"MaryReines\">\n\t\t\t\t\t\t\t\t\t<\/p>\n<p><span>By: <span>Mary\u00a0Reines<\/span><\/span>\n\t\t\t\t\t\t\t<\/p>\n<\/div>\n<p>\t\t\t\t<\/a><\/li>\n<li><a id=\"DigDeeperItem-4\" href=\"https:\/\/www.techtarget.com\/searchenterpriseai\/definition\/GPT-3\"><br \/>\n\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/visuals\/digdeeper\/4.jpg\" srcset=\"https:\/\/cdn.ttgtmedia.com\/visuals\/digdeeper\/4_searchsitetablet_520X173.jpg 960w,https:\/\/cdn.ttgtmedia.com\/visuals\/digdeeper\/4.jpg 1280w\" alt ><\/p>\n<h5>GPT-3<\/h5>\n<div>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/visuals\/WhatIs\/Ben Lutkevich.jpg\" alt=\"BenLutkevich\">\n\t\t\t\t\t\t\t\t\t<\/p>\n<p><span>By: <span>Ben\u00a0Lutkevich<\/span><\/span>\n\t\t\t\t\t\t\t<\/p>\n<\/div>\n<p>\t\t\t\t<\/a><\/li>\n<\/ul>\n<\/section>\n<\/div>\n<p><a href=\"https:\/\/www.computerweekly.com\/news\/365535664\/Tenable-opens-playground-for-generative-AI-cyber-tools\" class=\"button purchase\" rel=\"nofollow noopener\" target=\"_blank\">Read More<\/a><br \/>\n Jeanice Badon<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A set of generative AI cyber tools designed to help security researchers in reverse engineering, debugging and other areas of work have been made available for the community to experiment with By Alex Scroxton, Security Editor Published: 27 Apr 2023 16:15 The security community is being invited to explore the potential of generative artificial intelligence<\/p>\n","protected":false},"author":1,"featured_media":642487,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2481,46,69181],"tags":[],"class_list":{"0":"post-642486","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-opens","8":"category-technology","9":"category-tenable"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/642486","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/comments?post=642486"}],"version-history":[{"count":0,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/642486\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media\/642487"}],"wp:attachment":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media?parent=642486"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/categories?post=642486"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/tags?post=642486"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}