ActivityRDI: A Centralized Solution Framework for Activity Retrieval and Detection Intelligence Based on Knowledge Graphs, Large Language Models, and Imbalanced Learning

We propose a centralized Activity Retrieval and Detection Intelligence (ActivityRDI) solution framework, demonstrate its application performance in network threat detection in detail, and show its generalization to other domains. Network threat detection is challenging owing to the complex nature of attack activities and the limited historically revealed threat data from which to learn. To help enhance the existing methods (e.g., analytics, machine learning, and artificial intelligence) to detect the network threats, we propose a multi-agent AI solution for agile threat detection. In this solution, a knowledge graph is used to analyze changes in user activity patterns and calculate the risk of unknown threats. Then, an imbalanced learning model is used to prune and weight the knowledge graph and to calculate the risk of known threats. Finally, a large language model (LLM) is used to retrieve and interpret the risk associated with user activities from the knowledge graph and the imbalanced learning model. The preliminary results show that the solution improves the threat capture rate by 3–4% and adds natural language interpretations of the risk predictions based on user activities with 95% accuracy. Furthermore, a demonstration application has been built to show how the proposed solution framework can be deployed and used. The generalizability of the proposed solution in other domains is also shown through an application to customer engagement, with 97% accuracy.