用大模型自动执行安全策略，提升合规效率
On Automating Security Policies with Contemporary LLMs
- 结合上下文学习与检索增强生成，自动分解安全策略
- 在STIXv2和Windows API上测试，准确率、召回率均显著提升
- 适合安全自动化、AI驱动运维的开发者和研究人员
现代计算环境日益复杂，网络威胁愈发 sophisticated，亟需更稳健、自适应且自动化的安全执行机制。本文提出一个框架，利用大语言模型（LLMs）通过创新结合上下文学习与检索增强生成（RAG），实现攻击缓解策略的自动化合规。系统首先收集并管理工具与API规范，存入向量数据库以支持高效检索；随后构建架构流水线，将高层级缓解策略分解为具体任务，并转化为可执行的API调用序列。我们在公开的STIXv2格式威胁情报策略及Windows API文档上进行了实证评估，结果表明采用RAG相比非RAG基线，在精确率、召回率和F1分数上均有显著提升。
原文摘要 · Abstract (English)
The complexity of modern computing environments and the growing sophistication of cyber threats necessitate a more robust, adaptive, and automated approach to security enforcement. In this paper, we present a framework leveraging large language models (LLMs) for automating attack mitigation policy compliance through an innovative combination of in-context learning and retrieval-augmented generation (RAG). We begin by describing how our system collects and manages both tool and API specifications, storing them in a vector database to enable efficient retrieval of relevant information. We then detail the architectural pipeline that first decomposes high-level mitigation policies into discrete tasks and subsequently translates each task into a set of actionable API calls. Our empirical evaluation, conducted using publicly available CTI policies in STIXv2 format and Windows API documentation, demonstrates significant improvements in precision, recall, and F1-score when employing RAG compared to a non-RAG baseline.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。