CyRA: A Conversational SIEM Assistant for Space Infrastructure Security Using AI and Blockchain

Abstract

Growing digitization across critical infrastructure sectors has exposed mission-sensitive organizations to increasingly sophisticated cyber threats. Conventional Security Information and Event Management (SIEM) tools demand specialized knowledge of proprietary query syntax and present steep learning curves that hinder timely incident response. In this work, CyRA (Cybersecurity Response Assistant), a natural language-driven SIEM assistant engineered for space infrastructure security, is introduced. CyRA employs the Google Gemini Flash API to interpret analyst queries and return actionable threat intelligence, incorporates a purpose-built blockchain module utilizing SHA-256 hashing to produce tamper-proof audit records, and delivers adaptive data visualization through dynamic charts and tabular reports. The system is quantitatively evaluated using the UNSW-NB15 network intrusion benchmark [9], with a classification accuracy of 94.3%, precision of 93.8%, recall of 94.7%, and F1-score of 94.2%, with an average query response time of 1.3 seconds. The SHA-256 hash-chain report logging guarantees non-repudiable documentation of every security assessment. CyRAs constitute a distinctive contribution toward lowering the barrier to entry for SIEM-based security operations, uniting AI-powered conversational access with cryptographically secured reporting to meet the demanding requirements of critical infrastructure protection.

Keywords

Graphical Abstract

Novelty Statement

CyRA presents a first-of-its-kind fusion of large language model-driven conversational querying with blockchain-enforced immutable logging inside a unified SIEM workflow, empowering analysts without deep query expertise to conduct real-time threat investigations while preserving a cryptographically verifiable chain of evidence, with performance validated on publicly accessible benchmark data.