Cybersecurity Detection Classification with Reasoning-enabled Language Models

AI 中文解读

这项研究让AI安全系统从“看标签”升级为“先推理再判断”，就像给安全员配了个会思考的助手。过去安全运营中心每天要处理海量告警，AI直接给出“危险”或“安全”的结论，但经常误判，导致工作人员疲劳。现在，研究人员训练AI像侦探一样，先一步步分析攻击线索，再给出结论，准确率提升到了82.6%。更聪明的是，系统还会自我评估“这次判断有多自信”，对没把握的告警交给人工处理，有把握的自动拦截。实测下来，误报率大幅降低，安全团队每天最多能少处理四成以上的垃圾告警。这项技术的意义在于，它让AI不再是机械打标签的工具，而是能解释推理过程的安全专家。对普通人来说，这意味着企业网络防护会更智能，你的个人信息和隐私数据被黑客窃取的风险会降低，同时安全人员也能从枯燥的重复劳动中解放出来，专注于真正的威胁。

A major issue in Security Operations Centers (SOCs) is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-tunes large language models (LLMs) to emit a triage label directly, but does not train them to reason about whether a detection is a genuine threat. We train a chain-of-thought (CoT) reasoning-enabled triage classifier on real, human-labeled Windows endpoint detections by combining automated prompt optimization, self-training, and reinforcement learning with verifiable rewards. We find that CoT reasoning also degrades the label-token probabilities that automated triage relies on, so we separately train a calibrator that reads the full reasoning trace and estimates the probability that the verdict is correct. Our system reaches 82.6% test accuracy and, at the high-confidence operating point that governs automated triage, improves benign recall by 43.0% and malicious recall by 18.3% over a direct-label LLM classifier. We further show that the trained calibrator is necessary - an untrained confidence judge collapses high-confidence recall to zero - and that a finetuned 30B model significantly outperforms frontier general-purpose models, motivating targeted training over scale.