GenDFIR：通过检索增强生成与大语言模型推进网络事件时间线分析
GenDFIR: Advancing Cyber Incident Timeline Analysis Through Retrieval Augmented Generation and Large Language Models
AI总结：
GenDFIR结合Llama 3.1 8B与RAG智能体，通过结构化知识库检索事件上下文，实现自动化网络取证时间线分析，在合成数据上验证了可靠性与稳健性。
摘要：
网络时间线分析，或称取证时间线分析，在数字取证与事件响应（DFIR）中至关重要。它检查工件和事件，特别是时间戳和元数据，以检测异常、建立关联并重建事件时间线。传统方法依赖于结构化工件（如日志和文件系统元数据），使用专门工具进行证据识别和特征提取。本文介绍了GenDFIR，一个利用大语言模型（LLMs）的框架，具体采用Llama 3.1 8B的零样本模式，并与检索增强生成（RAG）智能体集成。事件数据被预处理为结构化知识库，使RAG智能体能够根据用户提示检索相关事件。LLM解释该上下文，提供语义增强。在受控环境中对合成数据进行的测试表明，GenDFIR具有可靠性和稳健性，展示了LLMs在自动化时间线分析和推进威胁检测方面的潜力。
英文摘要：
Cyber timeline analysis, or forensic timeline analysis, is crucial in Digital Forensics and Incident Response (DFIR). It examines artefacts and events particularly timestamps and metadata to detect anomalies, establish correlations, and reconstruct incident timelines. Traditional methods rely on structured artefacts, such as logs and filesystem metadata, using specialised tools for evidence identification and feature extraction. This paper introduces GenDFIR, a framework leveraging large language models (LLMs), specifically Llama 3.1 8B in zero shot mode, integrated with a Retrieval-Augmented Generation (RAG) agent. Incident data is preprocessed into a structured knowledge base, enabling the RAG agent to retrieve relevant events based on user prompts. The LLM interprets this context, offering semantic enrichment. Tested on synthetic data in a controlled environment, results demonstrate GenDFIR's reliability and robustness, showcasing LLMs potential to automate timeline analysis and advance threat detection.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
