加速事件响应：数据泄露报告的混合方法
Accelerating Incident Response: A Hybrid Approach for Data Breach Reporting
AI总结：
本文提出了一种混合恶意软件分析流程，利用大型语言模型和JSON模式自动化数据泄露报告，以提高合规性与效率。
摘要：
通用数据保护条例（GDPR）要求组织在发现个人数据泄露后72小时内向监管机构报告。满足这个严格的时间限制具有挑战性，因为事件响应人员必须手动将低层次的数字取证证据，如恶意软件痕迹、系统调用日志和网络捕获转换为结构化且符合法律要求的信息。技术证据与监管报告之间的鸿沟往往导致延迟、不完整的通知和分析师的高认知负担。我们提出了一种混合的恶意软件分析流程，自动化提取和组织与泄露相关的信息，特别关注以数据外泄为导向的Linux/ARM恶意软件，这种恶意软件由于物联网和嵌入式设备的广泛采用而迅速增加。该系统结合静态分析以识别潜在的外泄者，动态分析以重建其行为。它使用一个受正式JSON模式约束的大型语言模型（LLM），该模式与官方意大利隐私专员办公室的通知表单一致。LLM将异构的数字取证证据转换为结构化且符合合规要求的报告，供人类操作员快速验证。
英文摘要：
The General Data Protection Regulation (GDPR) requires organisations to notify supervisory authorities of personal data breaches within 72 hours of discovery. Meeting this strict deadline is challenging because incident responders must manually translate low-level forensic artefacts such as malware traces, system-call logs, and network captures into the structured, legally framed information required by data-protection authorities. This gap between technical evidence and regulatory reporting often results in delays, incomplete notifications, and a high cognitive burden on analysts. We propose a hybrid malware analysis pipeline that automates the extraction and organisation of breach-relevant information, with a particular focus on exfiltration-oriented Linux/ARM malware, which is rapidly increasing in prevalence due to the widespread adoption of IoT and embedded devices. The system combines static analysis to identify potential exfiltrators with dynamic analysis to reconstruct their behaviour. It employs a Large Language Model (LLM) constrained by a formal JSON schema aligned with the official Italian Garante Privacy notification form. The LLM transforms heterogeneous forensic artefacts into a structured, compliance-ready report that a human operator can rapidly validate.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
