Integration of generative artificial intelligence into the architecture of the SIEM system

In the context of escalating hybrid cyber threats and the intensification of cyber conflict, the problem of ensuring the resilience and security of critical infrastructure facilities acquires particular urgency and strategic importance. This issue reaches its highest degree of criticality in the military and defense sector, where any compromise of information assets or disruption of the standard functioning of information and communication systems can lead to irreversible destructive consequences for the state's defense capability. This paper investigates the limitations of traditional SIEM systems, which are based on deterministic rules and demonstrate low efficiency in detecting unknown threats, a high rate of false positives, and scalability issues. A formalization of the classical SIEM architecture was carried out to identify its functional components. Based on this analysis, an improved conceptual model for a next-generation SIEM system is proposed, enhanced with the capabilities of Generative Artificial Intelligence (GenAI). The key elements of the proposed model are a proactive threat modeling module, which uses GenAI to generate hypotheses about unknown attack vectors, and a generative verification and prioritization module, which applies deep semantic analysis for the automated validation and contextual enrichment of cyber incidents. The proposed architecture provides a conceptual shift from reactive monitoring to proactive, semanticallyoriented analysis, significantly increasing threat detection effectiveness, reducing the workload on analysts, and accelerating response times to critical cyber incidents, which is extremely important for the protection of strategic assets. Future research directions include the practical implementation and validation of the proposed modules, as well as the development of methodologies for evaluating their computational efficiency and scalability.