用大模型+检索增强，自动分析网络事件时间线
GenDFIR: Advancing Cyber Incident Timeline Analysis Through Retrieval Augmented Generation and Large Language Models
- 用Llama 3.1和RAG从日志中检索关联事件
- 在模拟数据上实现可靠的时间线重建
- 适合安全分析师快速响应威胁
网络事件时间线分析是数字取证与应急响应（DFIR）的关键环节，通过分析时间戳和元数据等痕迹，识别异常、建立关联并重构攻击过程。传统方法依赖结构化日志与文件系统元数据，需专用工具提取特征。本文提出GenDFIR框架，基于零样本模式的Llama 3.1 8B大语言模型，结合检索增强生成（RAG）机制。将事件数据预处理为结构化知识库，RAG根据用户提问检索相关事件，由LLM进行语义解析与上下文补全。在受控环境的合成数据上测试，结果表明该框架具备可靠性与鲁棒性，验证了大模型在自动化时间线分析与威胁检测中的潜力。
原文摘要 · Abstract (English)
Cyber timeline analysis, or forensic timeline analysis, is crucial in Digital Forensics and Incident Response (DFIR). It examines artefacts and events particularly timestamps and metadata to detect anomalies, establish correlations, and reconstruct incident timelines. Traditional methods rely on structured artefacts, such as logs and filesystem metadata, using specialised tools for evidence identification and feature extraction. This paper introduces GenDFIR, a framework leveraging large language models (LLMs), specifically Llama 3.1 8B in zero shot mode, integrated with a Retrieval-Augmented Generation (RAG) agent. Incident data is preprocessed into a structured knowledge base, enabling the RAG agent to retrieve relevant events based on user prompts. The LLM interprets this context, offering semantic enrichment. Tested on synthetic data in a controlled environment, results demonstrate GenDFIR's reliability and robustness, showcasing LLMs potential to automate timeline analysis and advance threat detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。