首个命令行语义嵌入模型与数据集，助力安全研究中的命令相似性分析。
CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research
- 用大语言模型生成2.85万对相似命令行，构建隐私合规数据集CyPHER。
- CmdCaliper模型仅3000万参数，性能超越参数量十倍大的现有模型。
- 适合网络安全、恶意行为检测及自动化分析方向的研究者使用。
本研究解决网络安全领域中命令行嵌入因隐私与监管限制导致数据匮乏的问题。我们提出首个相似命令行数据集CyPHER，训练集由28,520对相似命令行构成，基于大语言模型生成；测试集包含2,807对真实命令行数据。同时提出命令行嵌入模型CmdCaliper，可计算命令行的语义相似度。性能评估显示，最小版本的CmdCaliper（3000万参数）在多个任务（如恶意命令行检测、相似命令行检索）中优于参数量十倍于它的当前最优句子嵌入模型。本研究探索了大语言模型在网络安全数据生成中的可行性，并公开发布数据集、模型权重与全部代码，为未来研究提供基础支持。
原文摘要 · Abstract (English)
This research addresses command-line embedding in cybersecurity, a field obstructed by the lack of comprehensive datasets due to privacy and regulation concerns. We propose the first dataset of similar command lines, named CyPHER, for training and unbiased evaluation. The training set is generated using a set of large language models (LLMs) comprising 28,520 similar command-line pairs. Our testing dataset consists of 2,807 similar command-line pairs sourced from authentic command-line data. In addition, we propose a command-line embedding model named CmdCaliper, enabling the computation of semantic similarity with command lines. Performance evaluations demonstrate that the smallest version of CmdCaliper (30 million parameters) suppresses state-of-the-art (SOTA) sentence embedding models with ten times more parameters across various tasks (e.g., malicious command-line detection and similar command-line retrieval). Our study explores the feasibility of data generation using LLMs in the cybersecurity domain. Furthermore, we release our proposed command-line dataset, embedding models' weights and all program codes to the public. This advancement paves the way for more effective command-line embedding for future researchers.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。