Cybersecurity threat network traffic generation with large language models
A security feed normalizer aggregates and normalizes threat intelligence data across security feeds and extracts threat descriptors of cybersecurity threats from the aggregated/normalized data. A first large language model (LLM) determines whether each threat descriptor is informative, i.e., comprises sufficient information for reproducing/generating network traffic of the corresponding cybersecurity threat. For informative threat descriptors, a second LLM generates network traffic for the corresponding cybersecurity threats. The generated network traffic is used for subsequent remediation of corresponding threats.
1 . A method comprising:
aggregating threat intelligence data related to cybersecurity threats across one or more feeds;
for a threat descriptor of a cybersecurity threat from the aggregated threat intelligence data, prompting a first foundation model with a first prompt to obtain an indication of whether the threat descriptor is informative for generating network traffic related to the cybersecurity threat; and
based on indication by the first foundation model that the threat descriptor is informative, prompting a second foundation model with a second prompt to generate network traffic for the cybersecurity threat, wherein the second prompt comprises one or more task instructions to generate the network traffic for the cybersecurity threat based, at least in part, on the threat descriptor.
2 . The method of claim 1 , wherein the second prompt comprises instructions to generate the network traffic for the cybersecurity threat based on at least one of a type of content in the threat descriptor and a type of feed of the one or more feeds that comprises the threat descriptor.
3 . The method of claim 1 , wherein the first foundation model comprises a fine-tuned large language model, wherein the second foundation model comprises a large language model tuned with one or more prompts.
4 . The method of claim 1 , wherein the first prompt comprises instructions to determine whether the threat descriptor is informative based, at least in part, on whether the threat descriptor comprises at least one of proof-of-concept code, network traffic patterns, and exploit payloads for the cybersecurity threat.
5 . The method of claim 4 , wherein generating the network traffic for the cybersecurity threat comprises executing proof-of-concept code in the threat descriptor.
6 . The method of claim 1 , further comprising capturing the generated network traffic for subsequent remediation of the cybersecurity threat.
7 . The method of claim 6 , further comprising remediating the cybersecurity threat, wherein remediating the cybersecurity threat comprises at least one of identifying mitigation actions, creating Intrusion Prevention System (IPS) signatures, testing for security controls, and testing for evasions based, at least in part, on packet captures of the generated network traffic.
8 . A non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to:
extract threat descriptors for cybersecurity threats from one or more feeds; and
generate network traffic from the extracted threat descriptors, wherein the instructions to generate network traffic from the extracted threat descriptors comprise instructions to, for each threat descriptor of the extracted threat descriptors,
prompt a first foundation model with a first prompt to determine whether the threat descriptor is informative for generating network traffic for a corresponding cybersecurity threat; and
based on the first foundation model determining that the threat descriptor is informative, prompt a second foundation model with a second prompt to generate network traffic for the cybersecurity threat based, at least in part, on the threat descriptor.
9 . The machine-readable medium of claim 8 , wherein the program code further comprises instructions to, based on the first foundation model determining that the threat descriptor is uninformative, filter the threat descriptor from network traffic generation.
10 . The machine-readable medium of claim 8 , wherein the program code further comprises instructions to:
identify a first prompt template for the first prompt and a second prompt template for the second prompt based, at least in part, on a type of data in the threat descriptor and a type of feed of the one or more feeds from which the threat descriptor was extracted; and
populate the first prompt template and the second prompt template with at least the threat descriptor to obtain the first prompt and the second prompt, respectively.
11 . The machine-readable medium of claim 8 , wherein the program code further comprises instructions to capture the generated network traffic for subsequent remediation of corresponding ones of the cybersecurity threats.
12 . The machine-readable medium of claim 11 , wherein the program code further comprises instructions to remediate the ones of the cybersecurity threats, wherein the instructions to remediate the ones of the cybersecurity threats comprise instructions to at least one of identify mitigation actions, create Intrusion Prevention System (IPS) signatures, test for security controls, and test for evasions based, at least in part, on packet captures of the generated network traffic.
13 . The machine-readable medium of claim 8 , wherein the program code further comprises instructions to filter, from the extracted threat descriptors, threat descriptors corresponding to cybersecurity threats having severity scores below a threshold severity score.
14 . The machine-readable medium of claim 8 , wherein the instructions to extract the threat descriptors from the one or more feeds comprise instructions to normalize the threat descriptors according to at least one of data types in the threat descriptors and known formats of the one or more feeds.
15 . An apparatus comprising:
a processor; and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
crawl one or more feeds for cybersecurity threat intelligence data;
extract threat descriptors from the cybersecurity threat intelligence data; and
generate network from traffic the extracted threat descriptors, wherein the instructions to generate network traffic from the extracted threat descriptors comprise instructions executable by the processor to cause the apparatus to, for each threat descriptor of the extracted threat descriptors, prompt a first foundation model with a first prompt to determine whether the threat descriptor is informative for generating network traffic for a corresponding cybersecurity threat; and
based on the first foundation model determining that the threat descriptor is informative, prompt a second foundation model with a second prompt to generate network traffic for the cybersecurity threat based, at least in part, on the threat descriptor.
16 . The apparatus of claim 15 , wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to, based on the first foundation model determining that the threat descriptor is uninformative, filter the threat descriptor from network traffic generation.
17 . The apparatus of claim 15 , wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to:
identify a first prompt template for the first prompt and a second prompt template for the second prompt based, at least in part, on a type of data in the threat descriptor and a type of feed of the one or more feeds from which the threat descriptor was extracted; and
populate the first prompt template and the second prompt template with at least the threat descriptor to obtain the first prompt and the second prompt, respectively.
18 . The apparatus of claim 15 , wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to capture the generated network traffic for subsequent remediation of corresponding ones of the cybersecurity threats.
19 . The apparatus of claim 18 , wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to remediate the ones of the cybersecurity threats, wherein the instructions to remediate the ones of the cybersecurity threats comprise instructions executable by the processor to cause the apparatus to at least one of identify mitigation actions, create Intrusion Prevention System (IPS) signatures, test for security controls, and test for evasions based, at least in part, on packet captures of the generated network traffic.
20 . The apparatus of claim 15 , wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to filter, from the extracted threat descriptors, threat descriptors corresponding to cybersecurity threats having severity scores below a threshold severity score.