LogPrécis：释放语言模型用于自动化恶意日志分析
LogPrécis: Unleashing Language Models for Automated Malicious Log Analysis
AI总结：
本文提出基于语言模型的自动化分析工具 LogPrécis，通过为 Unix shell 攻击会话分配战术序列指纹，将约 40 万次攻击归约为 3,000 类，辅助安全专家高效理解攻击并提升防御响应能力。
摘要：
收集安全相关日志是理解攻击行为和诊断漏洞的关键。然而，其分析仍是一项艰巨的挑战。近期，语言模型（LMs）在理解自然语言和编程语言方面展现出无可比拟的潜力。由于日志包含本质上混乱和混淆的信息，语言模型是否以及如何对安全专家有用的问题随之产生。本文系统地研究了如何利用最先进的语言模型技术，自动分析文本类 Unix shell 攻击日志。我们提出了一套完整的设计方法论，并由此开发了 LogPrécis。它接收原始 shell 会话作为输入，自动识别并为会话的每个部分分配攻击者战术，即揭示攻击者目标的序列。我们展示了 LogPrécis 支持分析两个大型数据集的能力，这些数据集包含约 400,000 次独特的 Unix shell 攻击。LogPrécis 将其缩减为约 3,000 个指纹，每个指纹将具有相同战术序列的会话归为一组。它提供的抽象让分析师能更好地理解攻击、识别指纹、检测新颖性、关联相似攻击，并追踪攻击家族和变异。总体而言，作为开源发布的 LogPrécis 为更好、更快速响应的网络防御铺平了道路。
英文摘要：
The collection of security-related logs holds the key to understanding attack behaviors and diagnosing vulnerabilities. Still, their analysis remains a daunting challenge. Recently, Language Models (LMs) have demonstrated unmatched potential in understanding natural and programming languages. The question arises whether and how LMs could be also useful for security experts since their logs contain intrinsically confused and obfuscated information. In this paper, we systematically study how to benefit from the state-of-the-art in LM to automatically analyze text-like Unix shell attack logs. We present a thorough design methodology that leads to LogPrécis. It receives as input raw shell sessions and automatically identifies and assigns the attacker tactic to each portion of the session, i.e., unveiling the sequence of the attacker's goals. We demonstrate LogPrécis capability to support the analysis of two large datasets containing about 400,000 unique Unix shell attacks. LogPrécis reduces them into about 3,000 fingerprints, each grouping sessions with the same sequence of tactics. The abstraction it provides lets the analyst better understand attacks, identify fingerprints, detect novelty, link similar attacks, and track families and mutations. Overall, LogPrécis, released as open source, paves the way for better and more responsive defense against cyberattacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
