AI Analytics

• Data collected from SIEM (either our eyeCloudXOAR or third-party) is linked to eyeCloudAI, or logs collected by installing an Agent on security devices are analyzed using AI models.

• Significant reduction in security event analysis time
• AI handles approximately 20,000 analysis tasks per day → Effectively replaces over 650 personnel
• Expanded analysis coverage (can exceed daily analysis limits of monitoring personnel)
• When used with eyeCloudXOAR, enables automated task processing based on AI analysis results and management of the AI model lifecycle

• With LLM-based vector analysis and continual learning, it quickly adapts even with a small amount of data.
  It can be immediately reinforced with just one piece of feedback data, achieving approximately 29 times the data efficiency compared to CNN.

• The security-specialized On-Premise LLM assistant (eyeCloudAI Assistant) is the key differentiator.

• Automatic classification of threat events (99.8% accuracy), analysis of attack payloads, automatic generation of threat analysis reports, automatic mapping of CVE·CAPEC, and execution of automatic responses linked to SOAR playbooks are possible.

• AI Assistant: Acts as a 'helper' that provides summaries and analysis results based on operator commands
• Agentic AI: An 'autonomous' security system where multiple AI agents collaborate independently to autonomously assess and execute the entire process from detection to response

① Specialized training in security monitoring vs general knowledge base
② No data leakage due to operation in an on-premise closed network
③ Direct integration with SIEM/SOAR and execution of automation
④ One-time cost for deployment vs ongoing charges based on usage

• SecureLayer UEBA continuously reduces false positives with its AI-based Continual Learning feature.
  Even a single piece of feedback data is immediately reflected in the learning process, and the actual false positive rate of eyeCloudAI has decreased from 94.8% to 5.2%.
  Technical support for optimization is also provided during the initial operational period.

• With LLM-based vector analysis and Continual Learning, it quickly adapts even with a small amount of data.
  It can be immediately reinforced with just one piece of feedback data and has approximately 29 times the data efficiency compared to CNN.

• Yes, it is possible. Our unsupervised and reinforcement learning-based ML/UEBA technology detects unknown new threats.
  It analyzes long-term logs autonomously to track APT attacks and has the capability to complete reports automatically.

• It performs autonomous tuning by applying Self-Feedback Learning technology.
  However, for data that the model cannot classify, model updates are necessary through reinforcement learning.
  No additional feedback is required for the data that has been reinforced.

• We address this issue through a multi-agent collaboration system.
  The collection, analysis, and response agents share their respective roles and go through a workflow that verifies each other's results, ultimately ensuring that a human supervises and approves the process to maximize accuracy.