Module 5

AI Agents & LLMs

Build intelligent agents using Large Language Models for security automation

Learning Objectives

Understand LLM fundamentals and capabilities

Integrate OpenAI and Claude APIs

Build autonomous agents with tools

Implement prompt engineering techniques

Apply AI to security analysis and threat detection

Handle costs and rate limiting

LLM Fundamentals

What are Large Language Models?
Understanding LLM capabilities and limitations

Large Language Models (LLMs) are neural networks trained on vast amounts of text data. They can understand context, generate text, reason about problems, and perform various tasks with minimal task-specific training.

Strengths

Natural language understanding, code generation, analysis, creative writing, reasoning

Limitations

Hallucinations, outdated knowledge, no real-time data access, context window limits

Best Practices

Verify outputs, use system prompts, implement guardrails, monitor costs

Using LLM APIs

OpenAI API Integration
Using GPT models for various tasks
python
from openai import OpenAI\nimport os\n\nclient = OpenAI(api_key=os.getenv('OPENAI_API_KEY'))\n\nresponse = client.chat.completions.create(\n    model='gpt-4',\n    messages=[\n        {'role': 'system', 'content': 'You are a security expert.'},\n        {'role': 'user', 'content': 'Analyze this vulnerability: SQL injection'}\n    ],\n    temperature=0.7,\n    max_tokens=1000\n)\n\nprint(response.choices[0].message.content)\n\ndef analyze_code_for_vulnerabilities(code):\n    response = client.chat.completions.create(\n        model='gpt-4',\n        messages=[\n            {'role': 'system', 'content': 'Identify vulnerabilities and suggest fixes.'},\n            {'role': 'user', 'content': f'Analyze this code:\\n{code}'}\n        ]\n    )\n    return response.choices[0].message.content

Building AI Agents

AI Agent Architecture
Building autonomous decision-making systems
python
from openai import OpenAI\n\nclient = OpenAI()\n\nclass SimpleAgent:\n    def __init__(self, name, system_prompt):\n        self.name = name\n        self.system_prompt = system_prompt\n        self.conversation_history = []\n    \n    def think(self, user_input):\n        self.conversation_history.append({\n            'role': 'user',\n            'content': user_input\n        })\n        response = client.chat.completions.create(\n            model='gpt-4',\n            system=self.system_prompt,\n            messages=self.conversation_history\n        )\n        assistant_message = response.choices[0].message.content\n        self.conversation_history.append({\n            'role': 'assistant',\n            'content': assistant_message\n        })\n        return assistant_message\n\nagent = SimpleAgent('SecurityAnalyzer', 'You are a security expert.')\nresponse = agent.think('What are common web vulnerabilities?')\nprint(response)

Hands-On Project

Build an Intelligent Threat Analyzer
Create an AI agent that analyzes security threats and provides recommendations

Design an agent that fetches threat data, analyzes it using an LLM, and generates actionable security recommendations.

python
from openai import OpenAI\nimport requests\n\nclient = OpenAI()\n\nclass ThreatAnalyzerAgent:\n    def __init__(self, api_key):\n        self.api_key = api_key\n        self.system_prompt = '''You are an expert threat analyst. Analyze security threats and provide:\n1. Threat classification (malware, phishing, APT, etc.)\n2. Risk assessment (CRITICAL, HIGH, MEDIUM, LOW)\n3. Recommended actions\n4. Detection methods'''\n    \n    def fetch_threat_data(self, indicator):\n        try:\n            response = requests.get(\n                'https://api.abuseipdb.com/api/v2/check',\n                params={'ipAddress': indicator},\n                headers={'Key': self.api_key}\n            )\n            return response.json()\n        except Exception as e:\n            return {'error': str(e)}\n    \n    def analyze_threat(self, threat_data):\n        response = client.chat.completions.create(\n            model='gpt-4',\n            system=self.system_prompt,\n            messages=[{\n                'role': 'user',\n                'content': f'Analyze this threat data:\\n{threat_data}'\n            }]\n        )\n        return response.choices[0].message.content\n\nagent = ThreatAnalyzerAgent('your-abuseipdb-key')\nthreat_data = agent.fetch_threat_data('192.168.1.100')\nanalysis = agent.analyze_threat(threat_data)\nprint(analysis)