用大模型分析网络日志，发现隐藏的异常行为
Towards Characterizing Cyber Networks with Large Language Models
- 将网络日志转化为向量表示，通过聚类识别异常
- 在真实生产环境和物联网测试平台数据上验证，聚类结果与专家标注一致
- 适合网络安全研究人员和威胁狩猎人员参考
威胁狩猎需从大量嘈杂、高维的网络数据中识别稀疏的恶意活动。我们认为，无论攻击如何伪装，在高维空间中都难以完全隐藏。本文提出一种名为网络日志嵌入模型（CLEM）的原型工具，利用大语言模型对来自真实生产网络和物联网安全测试平台的Zeek网络流量日志进行训练。模型在滑动窗口数据上过拟合，以精细刻画每个时间窗口的特征。通过调整兰德指数（ARI）比较CLEM输出嵌入的k-means聚类结果与人工标注的一致性，验证了自然语言建模在理解网络数据方面的潜力。
原文摘要 · Abstract (English)
Threat hunting analyzes large, noisy, high-dimensional data to find sparse adversarial behavior. We believe adversarial activities, however they are disguised, are extremely difficult to completely obscure in high dimensional space. In this paper, we employ these latent features of cyber data to find anomalies via a prototype tool called Cyber Log Embeddings Model (CLEM). CLEM was trained on Zeek network traffic logs from both a real-world production network and an from Internet of Things (IoT) cybersecurity testbed. The model is deliberately overtrained on a sliding window of data to characterize each window closely. We use the Adjusted Rand Index (ARI) to comparing the k-means clustering of CLEM output to expert labeling of the embeddings. Our approach demonstrates that there is promise in using natural language modeling to understand cyber data.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。