TY - GEN
T1 - Labeling NIDS Rules with MITRE ATT &CK Techniques Using ChatGPT
AU - Daniel, Nir
AU - Kaiser, Florian Klaus
AU - Dzega, Anton
AU - Elyashar, Aviad
AU - Puzis, Rami
N1 - Publisher Copyright: © The Author(s), under exclusive license to Springer Nature Switzerland AG 2024.
PY - 2024/1/1
Y1 - 2024/1/1
N2 - A typical analyst spends much time and effort investigating alerts from network intrusion detection systems (NIDS). Available NIDS rules for enterprise and industrial control systems are not always accompanied by high-level explanations that allow for building valid hypotheses about the attacker’s techniques and intentions. The plethora of rules and the lack of high-level information necessitates new automated methods for alert enrichment. Large language models, such as ChatGPT, encompass a vast amount of knowledge, including cyber threat intelligence such as ports and protocols (low-level) and MITRE ATT &CK techniques (high-level). Despite being a very new technology, ChatGPT is increasingly used in order to automate processes that experts previously performed. In this paper, we explore the ability of ChatGPT to reason about NIDS rules while labeling them with MITRE ATT &CK techniques. We discuss prompt design and present results on ChatGPT-3.5, ChatGPT-4, and a keyword-based approach. Our results indicate that both versions of ChatGPT outperform a baseline that relies on a-priori frequencies of the techniques. ChatGPT-3.5 is much more precise than ChatGPT-4, with a little reduction in recall.
AB - A typical analyst spends much time and effort investigating alerts from network intrusion detection systems (NIDS). Available NIDS rules for enterprise and industrial control systems are not always accompanied by high-level explanations that allow for building valid hypotheses about the attacker’s techniques and intentions. The plethora of rules and the lack of high-level information necessitates new automated methods for alert enrichment. Large language models, such as ChatGPT, encompass a vast amount of knowledge, including cyber threat intelligence such as ports and protocols (low-level) and MITRE ATT &CK techniques (high-level). Despite being a very new technology, ChatGPT is increasingly used in order to automate processes that experts previously performed. In this paper, we explore the ability of ChatGPT to reason about NIDS rules while labeling them with MITRE ATT &CK techniques. We discuss prompt design and present results on ChatGPT-3.5, ChatGPT-4, and a keyword-based approach. Our results indicate that both versions of ChatGPT outperform a baseline that relies on a-priori frequencies of the techniques. ChatGPT-3.5 is much more precise than ChatGPT-4, with a little reduction in recall.
KW - Alerts investigation
KW - Cyber threat intelligence
KW - Natural language processing
UR - http://www.scopus.com/inward/record.url?scp=85188683063&partnerID=8YFLogxK
U2 - 10.1007/978-3-031-54129-2_5
DO - 10.1007/978-3-031-54129-2_5
M3 - Conference contribution
SN - 9783031541285
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 76
EP - 91
BT - Computer Security. ESORICS 2023 International Workshops - CPS4CIP, ADIoT, SecAssure, WASP, TAURIN, PriST-AI, and SECAI, 2023, Revised Selected Papers
A2 - Katsikas, Sokratis
A2 - Abie, Habtamu
A2 - Ranise, Silvio
A2 - Verderame, Luca
A2 - Cambiaso, Enrico
A2 - Ugarelli, Rita
A2 - Praça, Isabel
A2 - Li, Wenjuan
A2 - Meng, Weizhi
A2 - Furnell, Steven
A2 - Katt, Basel
A2 - Pirbhulal, Sandeep
A2 - Shukla, Ankur
A2 - Ianni, Michele
A2 - Dalla Preda, Mila
A2 - Choo, Kim-Kwang Raymond
A2 - Pupo Correia, Miguel
A2 - Abhishta, Abhishta
A2 - Sileno, Giovanni
A2 - Alishahi, Mina
A2 - Kalutarage, Harsha
A2 - Yanai, Naoto
PB - Springer Science and Business Media Deutschland GmbH
T2 - International Workshops which were held in conjunction with 28th European Symposium on Research in Computer Security, ESORICS 2023
Y2 - 25 September 2023 through 29 September 2023
ER -
