在 EDR 解决方案中利用 LLM 实现自动化 Hands-on-Keyboard 攻击检测
Towards Automatic Hands-on-Keyboard Attack Detection Using LLMs in EDR Solutions
AI总结：
本文提出将端点活动转为叙事文本，利用 LLM 结合窗口切分与双重训练检测 HOK 攻击，实验显示其有望优于传统机器学习方法。
摘要：
Endpoint Detection and Remediation（EDR，端点检测与修复）平台对于识别和应对网络威胁至关重要。本研究提出了一种使用 Large Language Models（LLM，大语言模型）检测 Hands-on-Keyboard（HOK，人工键盘操作）网络攻击的新方法。我们的方法包括将端点活动数据转换为 LLM 可分析的叙事形式，以区分正常操作与潜在的 HOK 攻击。我们通过将叙事切分为窗口并采用双重训练策略，解决了解释端点数据的挑战。结果表明，基于 LLM 的模型有潜力优于传统机器学习方法，为增强 EDR 能力并在网络安全中应用 LLM 提供了有前景的方向。
英文摘要：
Endpoint Detection and Remediation (EDR) platforms are essential for identifying and responding to cyber threats. This study presents a novel approach using Large Language Models (LLMs) to detect Hands-on-Keyboard (HOK) cyberattacks. Our method involves converting endpoint activity data into narrative forms that LLMs can analyze to distinguish between normal operations and potential HOK attacks. We address the challenges of interpreting endpoint data by segmenting narratives into windows and employing a dual training strategy. The results demonstrate that LLM-based models have the potential to outperform traditional machine learning methods, offering a promising direction for enhancing EDR capabilities and apply LLMs in cybersecurity.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
