Beyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence

Beyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence

Speakers: Cydney Stude (Security Engineer, Amazon/AWS); Steve de Vera (Senior Security Engineer, Amazon/AWS); Vamshi Krishna Edamadaka (Data Scientist, Amazon Web Services)

Conference: FIRST CTI Conference

YouTube: https://www.youtube.com/watch?v=39kO7jUzG7U

Overview

In an era where cyber threats are escalating in volume and sophistication, security teams often find themselves outmatched by the sheer scale of data and the scarcity of human resources. The talk "Beyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence" by Cydney Stude, Steve de Vera, and Vamshi Krishna Edamadaka from Amazon/AWS addresses this critical challenge head-on. The presentation details their journey in developing and operationalizing an AI-powered security tool designed to drastically improve the efficiency and efficacy of cyber threat intelligence (CTI) operations within AWS's security incident response service.

The core of this talk revolves around a hybrid AI methodology, integrating traditional programming with advanced machine learning to automate the extraction and analysis of threat data from vast log datasets. The speakers candidly share their lessons learned, critical decision criteria, and the mistakes made during the development process, offering invaluable insights for any organization looking to leverage AI in their security workflows. This presentation is particularly significant for security engineers, data scientists, and CTI analysts grappling with the limitations of manual analysis and seeking to scale their defensive capabilities against an ever-evolving threat landscape.

This initiative by AWS underscores a pivotal shift in how large enterprises approach CTI – moving beyond reactive human-centric analysis to proactive, AI-augmented intelligence. By demonstrating how they transformed a manual, time-consuming process into an automated, high-throughput system capable of processing nearly a billion log records in minutes, the AWS team provides a compelling blueprint for integrating AI as a force multiplier. Their emphasis on understanding business needs, building trust frameworks, and planning for production scale offers a practical guide for bridging the gap between AI consumption and AI creation in critical security functions.

Background

▶ Watch: Introduction: Building an AI Security Tool (0:00)

The genesis of this project stemmed from a pervasive challenge faced by many large security organizations: a significant headcount deficit in relation to the ever-increasing volume of security incidents and threat data. As Steve de Vera highlighted, AWS's security teams, operating on the customer side of the shared responsibility model, were inundated with the need for threat analysts to scrutinize incidents and identify overarching trends. Manual log analysis was proving to be a bottleneck, limiting the ability to correlate patterns across numerous cases and derive timely, actionable intelligence.

To address this, AWS leadership issued a directive to explore and implement AI more extensively into their security operations. This led to an operational discovery phase, where the team meticulously documented their weekly tasks to identify repetitive activities with clearly defined inputs and consistent application logic. This process revealed that while human judgment remained irreplaceable for certain aspects, significant portions of their work involved tasks that were ripe for automation. This discovery formed their "automation roadmap," focusing primarily on data analysis with some elements of code generation.

The team recognized a critical gap: they possessed vast amounts of security data, particularly AWS CloudTrail logs, but lacked an efficient, scalable mechanism to transform this raw data into meaningful, categorized threat intelligence. To bridge this, they developed the Threat Technique Catalog for AWS, an extension of the widely recognized MITRE ATT&CK framework. This catalog provides AWS-specific IDs and content, derived from real-world observations of threat actor activities during security incidents, serving as a crucial classification system for their automated analysis efforts. This foundational work set the stage for building a tool that could ingest raw CloudTrail data, identify malicious activities, and categorize them according to their custom threat intelligence framework.

Key Findings

▶ Watch: Case Study: Hybrid Threat Data Extraction Tool (6:10)

The AWS team's journey into AI-driven CTI yielded several profound insights and key findings that shaped their successful implementation:

1. The Indispensability of Hybrid AI: A pure AI approach proved insufficient. The most effective solution was a hybrid method that combined traditional, deterministic programming with AI enhancements. This allowed them to leverage the precision and reliability of established logic for initial processing steps, while employing AI for more complex, pattern-recognition tasks like kill chain generation and summarization. This approach mitigated the non-deterministic nature of AI outputs and improved overall accuracy.

1. Operational Discovery as a Prerequisite for Automation: Before any AI tool could be built, a deep understanding of existing business processes was paramount. The team conducted thorough operational discovery to identify repetitive, manual tasks with consistent inputs. This foundational step was critical for defining the scope of automation opportunities and ensuring the AI solution addressed real operational pain points, rather than building technology for technology's sake.

1. Trust is Synonymous with Value: A critical lesson learned was that "loss of trust was actually loss of use, which actually is loss of value." Incident responders, the primary consumers of the tool's output, would disregard it if they couldn't confidently rely on its accuracy. To counter this, the team focused on building trust frameworks upfront, providing transparency into the tool's inputs, its high-level logic, and how it derived its conclusions. Empowering users with this knowledge enabled them to make informed judgments and integrate the tool effectively into their workflows.

1. POC is Not Production: The challenges of scaling an AI solution from a proof-of-concept (POC) to a production environment were significant. While POCs often run smoothly with controlled inputs and limited users, production demands require robust infrastructure, careful consideration of throughput limitations, and linear scalability. Planning for production scale from day one, including infrastructure design and resource allocation, was identified as crucial for successful deployment.

1. Critical Measurements for AI Adoption: The team established a set of decision criteria to determine when and how to apply AI:

• Criticality of Output: For highly critical downstream processes (e.g., triggering alarms), deterministic models were preferred over non-deterministic AI outputs to avoid noise.
• Accuracy vs. Throughput: A balance had to be struck between the speed of AI-generated results and the desired level of accuracy, acknowledging that AI might struggle to match human-level precision.
• Acceptable Error Rates: AI was deemed suitable for tasks where a certain margin of error was permissible, allowing for creative or approximate answers.
• Volume of Inputs: AI excelled in processing massive datasets that would overwhelm human analysts.
• Systems Information and Permissions: Thorough threat modeling of the AI tool's access and potential impact on the attack surface was essential to mitigate security risks.

These findings collectively emphasize that successful AI integration in CTI is not merely a technological challenge but also an organizational, process-driven, and trust-building endeavor.

Technical Deep Dive

▶ Watch: Tool Results: Processing Billions of Records Rapidly (12:50)

The core of AWS's solution is a sophisticated threat data extraction tool that employs a hybrid method to analyze vast volumes of security logs. This tool's architecture is divided into two primary layers: a deterministic logic layer and an AI enhancement layer.

The input to the system consists of raw log data from security cases, specifically AWS CloudTrail logs. CloudTrail logs record every action performed in an AWS account, whether by a legitimate user or a threat actor. The challenge lies in sifting through potentially millions of these events to identify malicious activity and construct a coherent narrative of an attack.

1. Deterministic Logic Layer:

The first stage of the tool leverages traditional programming to perform an initial, highly accurate filtering of the raw log data. This layer employs a Python recursive Depth-First Search (DFS) algorithm to process the input logs. Its primary function is to distinguish legitimate user activity from potential threat actor activity. The output of this layer is a refined dataset containing only threat actor-attributed CloudTrail logs, typically in a CSV format. This deterministic filtering is crucial because it reduces the noise significantly before any AI processing, ensuring that the subsequent, more resource-intensive AI layer operates on relevant data. As noted in the Q&A, this layer also utilizes parallel processing to handle the immense volume of data efficiently.

1. AI Enhancement Layer:

Once the deterministic layer has isolated threat actor activity, the AI enhancement layer takes over to build kill chains and generate summaries. This layer's process is intricate and designed to maximize the utility of AI while mitigating its non-deterministic drawbacks:

• Data Conversion to Graph: The CSV data of threat actor-only CloudTrail logs is first converted into a graph structure. In this graph, each node represents an individual API call (a CloudTrail event), and edges represent the temporal or causal relationships between these calls. This graph representation is vital for easily tracing activity sequences and identifying root causes.

• API Call Classification: Each API call (node) in the graph is then classified using the Threat Technique Catalog for AWS. This catalog, an extension of the MITRE ATT&CK framework, assigns AWS-specific threat technique IDs and categories such as "initial access," "discovery," "impact," and "exfiltration." This classification provides semantic meaning to each action, allowing for a structured understanding of the threat actor's objectives.

• Graph Traversal for Action Sequences: The system then traverses the graph, specifically tracing back from every identified "impact" action to its corresponding "initial access" point. This process generates multiple potential sequences of actions, representing various paths a threat actor might have taken.

• Pruning and Filtering with Embeddings: The initial sequences often contain "noise"—benign or less important read-only actions that do not contribute meaningfully to the kill chain. To refine these, the tool uses embeddings. Each API call is embedded into a high-dimensional vector space. The similarity of an API call's embedding to the embedding of the "impact" action is then calculated. API calls that are not semantically similar or important in the context of the impact action are pruned from the sequence. This ensures that only the most relevant actions form part of the final kill chain.

• Semantic Ranking: After pruning, the remaining kill chain candidates are subjected to semantic ranking. This step orders the kill chains based on their importance and relevance, leveraging the contextual information gleaned from the classified API calls and their relationships.

• LLM-Powered Generation: Crucially, a Large Language Model (LLM) is only employed after all the deterministic processing, graph analysis, classification, pruning, and ranking have occurred. The LLM is not fed raw logs; instead, it receives a refined, semantically rich set of ranked kill chains. Its role is to generate and select the final, most coherent kill chains and then produce concise summaries based on these validated sequences. This approach prevents the LLM from hallucinating or introducing inaccuracies from raw, unstructured data.

• Validation Mechanism: To ensure the quality and accuracy of the generated kill chains and summaries, the tool incorporates a robust validation mechanism. This includes custom validation models and a human-in-the-loop component. The generated summary is compared against existing case summaries or incident tickets to assess its fidelity and completeness.

The results of this hybrid approach are remarkable. The tool can process massive files, such as 990 million records, in under 25 minutes. This contrasts sharply with the weeks or months it would take a human incident responder to perform the same analysis. Furthermore, it enables searching across billions of actions and hundreds of thousands of cases, successfully identifying common threat patterns that would be nearly impossible to detect manually. This capability allows security teams to move "beyond human scale" in their CTI efforts.

Demo / Proof of Concept

▶ Watch: Decision Criteria: When and How to Use AI (14:00)

While the presentation did not feature a live, interactive demonstration of the tool in action, the speakers provided a comprehensive conceptual walkthrough and detailed the operational capabilities and performance metrics of their threat data extraction tool. They described the tool's architecture, including the deterministic and AI enhancement layers, and explained how it processes AWS CloudTrail logs to identify threat actor activity, construct kill chains, and generate summaries.

The "Demo / Proof of Concept" aspect was conveyed through the tangible results and performance statistics shared, illustrating the tool's effectiveness rather than a real-time display. The impressive figure of processing 990 million records in under 25 minutes served as a powerful testament to the tool's capabilities, implicitly showcasing its potential and the success of the hybrid AI approach. This focus on the methodology, operational challenges, and quantifiable outcomes effectively demonstrated the tool's value and how it works in practice, even without a live demo.

Defensive Implications

▶ Watch: Q&A: How the Tool Achieved High Speed (22:20)

The AWS team's work on their AI-powered threat data extraction tool offers several critical implications for defensive security operations:

1. Scale Threat Intelligence Beyond Human Capacity: The most apparent implication is the ability to process and analyze volumes of security data that are simply unmanageable for human analysts. By automating the extraction of kill chains and threat summaries from nearly a billion log records in minutes, organizations can dramatically accelerate their CTI efforts, leading to faster detection, response, and proactive defense.

1. Free Up Human Analysts for Higher-Value Tasks: Automating repetitive, data-intensive tasks like log analysis liberates skilled threat analysts from tedious work. This allows them to focus on more complex problem-solving, deep-dive investigations, trend analysis, and strategic threat hunting – areas where human expertise and judgment are irreplaceable.

1. Enhance Pattern Recognition and Correlation: The tool's ability to search across "billions of actions across hundreds and thousands of cases" enables the discovery of common threat patterns that would otherwise remain hidden. This cross-incident correlation is invaluable for identifying new attacker tactics, techniques, and procedures (TTPs), understanding campaign objectives, and improving overall defensive posture.

1. Adopt a Hybrid AI Strategy: The success of the "deterministic logic layer" combined with the "AI enhancement layer" underscores the importance of a hybrid AI approach. Defenders should consider where traditional, rule-based programming offers reliability and precision, and where AI/ML can provide scale, pattern recognition, and summarization capabilities. This balanced approach mitigates the risks associated with purely AI-driven non-deterministic outputs.

1. Develop Internal Threat Technique Catalogs: Extending frameworks like MITRE ATT&CK with organization-specific threat techniques, as AWS did with their Threat Technique Catalog for AWS, is crucial. This customization allows AI models to classify activities more accurately within a specific operational context, making the generated intelligence highly relevant and actionable.

1. Prioritize Trust and Transparency in AI Tools: For AI tools to be adopted and utilized effectively by security teams, trust is paramount. Defenders building or integrating AI solutions must design them with transparency, providing insights into their logic, inputs, and how outputs are derived. Establishing clear validation strategies and potentially incorporating "human-in-the-loop" mechanisms will foster confidence among end-users.

1. Thorough Threat Modeling for AI Systems: The speakers emphasized considering "systems information" and "security implications" during architectural design. Defenders must conduct rigorous threat modeling for any AI tool, assessing its permissions, access to critical systems, potential for unauthorized use, and how it might impact the organization's overall attack surface. This proactive security-by-design approach is vital for protecting the AI solution itself.

1. Strategic Planning for Scale and Cost: Implementing AI at scale is not trivial. Organizations must plan for production-level throughput, infrastructure requirements, and the financial implications of AI model inference (e.g., token usage for LLMs) from the outset. Early consideration of these factors can prevent costly redesigns and ensure operational viability.

By internalizing these implications, security teams can strategically integrate AI and automation to transform their CTI capabilities, making their defenses more resilient, efficient, and intelligent in the face of escalating cyber threats.

Key Takeaways

• AI is a Tool, Not a Replacement: AI, much like calculators or computers in their time, serves as a powerful tool to augment human capabilities, not to fully replace human analysts in cyber threat intelligence (CTI) functions.
• Understand Your Business First: A deep understanding of existing business processes and the identification of repetitive, automatable tasks are foundational prerequisites for successful AI and automation initiatives in security.
• Hybrid AI for Optimal Results: Combining deterministic, traditional programming with AI enhancement layers yields more accurate, trustworthy, and cost-effective solutions for complex security data analysis compared to a purely AI-driven approach.
• Build Trust Frameworks Early: For AI tools to be truly valuable, end-users (like incident responders) must trust their outputs. Transparency into the tool's logic, inputs, and validation mechanisms is essential for fostering adoption and maximizing impact.
• Plan for Production Scale and Cost: When developing AI solutions, it is crucial to design for production scale, throughput, and consider the significant cost implications (e.g., LLM token usage, infrastructure) from the very beginning to ensure operational viability.
• Leverage AI for Data Analysis at Scale: AI excels at processing and correlating vast volumes of security logs (e.g., 990 million records in under 25 minutes), enabling the identification of threat patterns and kill chains that are beyond human analytical capacity.

About the Speaker(s)

Steve de Vera is a Senior Security Engineer for AWS, specifically within the AWS Security Incident Response Service. His expertise spans threat intelligence, threat research, and incident response, focusing on understanding and countering cyber threats to AWS's environment.

Vamshi Krishna Edamadaka is a Data Scientist working with Steve de Vera on the security incident response team at AWS. His primary role involves leveraging machine learning and artificial intelligence to extract actionable insights and patterns from complex threat data, including the creation of custom AI models and live investigation agents.

Cydney Stude is a Security Engineer on the AWS Customer Incident Response Team. As an incident responder, her work focuses on translating lessons learned from threat research and incident analysis into practical, actionable outcomes and improved security posture for AWS customers.