Communication Dans Un Congrès Année : 2025

Towards Automated Botnet Threat Intelligence with Knowledge-Guided Large Language Models

Résumé

Botnets are large-scale networks of compromised devices that enable attackers to launch coordinated cyberattacks such as DDoS, credential theft, cryptojacking, and malware propagation. Their rapid propagation and stealth techniques make early detection and timely response particularly challenging. Cyber Threat Intelligence (CTI) is essential for mitigating such threats, but its production is still predominantly manual, requiring analysts to interpret raw logs and this process is too slow, resource-intensive, and difficult to scale against automated botnets. In this paper, we propose a novel approach to automate botnet CTI generation directly from honeypot-captured intrusions. We rely on highinteraction honeypots to capture various botnet samples. The collected data is then analyzed using large language models (LLMs), guided by structured prompts constructed from previously observed botnet actions mapped to the MITRE ATT&CK framework. We first perform manual analyses of real botnet sessions to construct structured datasets of tactics, techniques, and procedures (TTPs) for each botnet intrusion. These resources are then used for prompt engineering, enabling LLMs to transform raw system and network logs into structured CTI reports through in-context learning (ICL). Preliminary results demonstrate that LLMs can generate coherent and actionable reports, which can help in understanding the operating modes of botnets and in developing effective countermeasures.

Fichier principal
Vignette du fichier
TowardsAutomatedBotnetCTI.pdf (1.34 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-05411121 , version 1 (11-12-2025)

Licence

Identifiants

  • HAL Id : hal-05411121 , version 1

Citer

Bassirou Badiane, Valérie Viet Triem Tong, Yufei Han. Towards Automated Botnet Threat Intelligence with Knowledge-Guided Large Language Models. FPS 2025 - 18th International Symposium on Foundations & Practice of Security, Nov 2025, Brest, France. ⟨hal-05411121⟩
546 Consultations
332 Téléchargements

Partager

  • More