LogPrécis: Unleashing Language Models for Automated Malicious Log Analysis
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2023
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866929285567086592 |
|---|---|
| author | Boffa, Matteo Valentim, Rodolfo Vieira Vassio, Luca Giordano, Danilo Drago, Idilio Mellia, Marco Houidi, Zied Ben |
| author_facet | Boffa, Matteo Valentim, Rodolfo Vieira Vassio, Luca Giordano, Danilo Drago, Idilio Mellia, Marco Houidi, Zied Ben |
| contents | The collection of security-related logs holds the key to understanding attack behaviors and diagnosing vulnerabilities. Still, their analysis remains a daunting challenge. Recently, Language Models (LMs) have demonstrated unmatched potential in understanding natural and programming languages. The question arises whether and how LMs could be also useful for security experts since their logs contain intrinsically confused and obfuscated information. In this paper, we systematically study how to benefit from the state-of-the-art in LM to automatically analyze text-like Unix shell attack logs. We present a thorough design methodology that leads to LogPrécis. It receives as input raw shell sessions and automatically identifies and assigns the attacker tactic to each portion of the session, i.e., unveiling the sequence of the attacker's goals. We demonstrate LogPrécis capability to support the analysis of two large datasets containing about 400,000 unique Unix shell attacks. LogPrécis reduces them into about 3,000 fingerprints, each grouping sessions with the same sequence of tactics. The abstraction it provides lets the analyst better understand attacks, identify fingerprints, detect novelty, link similar attacks, and track families and mutations. Overall, LogPrécis, released as open source, paves the way for better and more responsive defense against cyberattacks. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2307_08309 |
| institution | arXiv |
| publishDate | 2023 |
| record_format | arxiv |
| spellingShingle | LogPrécis: Unleashing Language Models for Automated Malicious Log Analysis Boffa, Matteo Valentim, Rodolfo Vieira Vassio, Luca Giordano, Danilo Drago, Idilio Mellia, Marco Houidi, Zied Ben Cryptography and Security Artificial Intelligence Networking and Internet Architecture The collection of security-related logs holds the key to understanding attack behaviors and diagnosing vulnerabilities. Still, their analysis remains a daunting challenge. Recently, Language Models (LMs) have demonstrated unmatched potential in understanding natural and programming languages. The question arises whether and how LMs could be also useful for security experts since their logs contain intrinsically confused and obfuscated information. In this paper, we systematically study how to benefit from the state-of-the-art in LM to automatically analyze text-like Unix shell attack logs. We present a thorough design methodology that leads to LogPrécis. It receives as input raw shell sessions and automatically identifies and assigns the attacker tactic to each portion of the session, i.e., unveiling the sequence of the attacker's goals. We demonstrate LogPrécis capability to support the analysis of two large datasets containing about 400,000 unique Unix shell attacks. LogPrécis reduces them into about 3,000 fingerprints, each grouping sessions with the same sequence of tactics. The abstraction it provides lets the analyst better understand attacks, identify fingerprints, detect novelty, link similar attacks, and track families and mutations. Overall, LogPrécis, released as open source, paves the way for better and more responsive defense against cyberattacks. |
| title | LogPrécis: Unleashing Language Models for Automated Malicious Log Analysis |
| topic | Cryptography and Security Artificial Intelligence Networking and Internet Architecture |
| url | https://arxiv.org/abs/2307.08309 |