安全日志到ATT&CK洞察：利用大语言模型实现高层威胁理解与认知特质推断
Security Logs to ATT&CK Insights: Leveraging LLMs for High-Level Threat Understanding and Cognitive Trait Inference
AI总结：
本文提出利用大语言模型分析Suricata IDS日志，将底层网络事件映射到MITRE ATT&CK技术，并推断攻击者的认知偏差（如损失厌恶），为行为自适应网络防御奠定基础。
摘要：
在网络安全中，理解对抗性行为传统上依赖于高层情报报告和对攻击链的人工解读。然而，实时防御要求能够直接从入侵检测系统（IDS）日志等底层系统遥测数据中推断攻击者的意图和认知策略。在本文中，我们提出了一种新颖的框架，利用大语言模型（LLMs）分析Suricata IDS日志，并根据MITRE ATT&CK技术推断攻击者的行为。我们的方法基于这样一个假设：攻击者的行为反映了潜在的认知偏差，如损失厌恶、风险承受或目标坚持，这些偏差可以通过对日志序列的仔细观察来提取和建模。这为未来在行为自适应网络防御和认知特质推断方面的研究奠定了基础。我们开发了一个策略驱动的提示系统，以高效的方式将大量网络日志数据分割成不同的行为阶段，使LLM能够将每个阶段与可能的技术和潜在的认知动机相关联。通过将网络层事件映射到高层攻击者策略，我们的方法揭示了工具切换、协议转换或横向移动模式等行为信号如何对应心理上有意义的决策点。结果表明，LLMs能够弥合数据包级日志与战略意图之间的语义鸿沟，为认知自适应网络防御提供了一条途径。
英文摘要：
Understanding adversarial behavior in cybersecurity has traditionally relied on high-level intelligence reports and manual interpretation of attack chains. However, real-time defense requires the ability to infer attacker intent and cognitive strategy directly from low-level system telemetry such as intrusion detection system (IDS) logs. In this paper, we propose a novel framework that leverages large language models (LLMs) to analyze Suricata IDS logs and infer attacker actions in terms of MITRE ATT&CK techniques. Our approach is grounded in the hypothesis that attacker behavior reflects underlying cognitive biases such as loss aversion, risk tolerance, or goal persistence that can be extracted and modeled through careful observation of log sequences. This lays the groundwork for future work on behaviorally adaptive cyber defense and cognitive trait inference. We develop a strategy-driven prompt system to segment large amounts of network logs data into distinct behavioral phases in a highly efficient manner, enabling the LLM to associate each phase with likely techniques and underlying cognitive motives. By mapping network-layer events to high-level attacker strategies, our method reveals how behavioral signals such as tool switching, protocol transitions, or pivot patterns correspond to psychologically meaningful decision points. The results demonstrate that LLMs can bridge the semantic gap between packet-level logs and strategic intent, offering a pathway toward cognitive-adaptive cyber defense. Keywords: Cognitive Cybersecurity, Large Language Models (LLMs), Cyberpsychology, Intrusion Detection Systems (IDS), MITRE ATT&CK, Cognitive Biases
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
