系統日誌 TTP 威脅情報狩獵深度學習方法

Abstract

本論文提出一套結合深度學習與大型語言模型（Large Language Models, LLMs）之威脅情資導向偵測框架，用以從 Windows 事件日誌中辨識、解讀並泛化惡意或可疑行為。 為解決高品質標註資料稀缺、行為註記不足，以及事件脈絡片段化等挑戰，本研究採用 MITRE Caldera 與 Atomic Red Team 進行多階段攻擊模擬實驗（adversary emulation）。透過此類受控實驗活動，產生涵蓋行程（process）、檔案系統操作、登錄檔（registry）修改及網路通訊等高擬真度日誌，並依 MITRE ATT&CK 對惡意行為的定義逐一對事件進行對應與標註，建構出一組可重現、行為資訊豐富的資料集，藉以捕捉真實攻擊活動樣態。 本論文提出之方法整合多階段特徵學習（representation learning）流程，並結合下游深度學習與 LLM 輔助分類模型。在語意階段，每筆事件被轉換為主詞–關係–受詞（Subject–Relation–Object, S-R-O）結構，並依資料型態採用對應之領域專用 BERT 模型進行編碼（embedding）：命令列（command-line）調用採用以大規模命令列資料訓練之模型（CmdCaliper）以捕捉攻擊者意圖；檔案路徑與登錄檔鍵值則分別採用兩個自行訓練之模型，以學習檔案路徑與登錄檔系統之階層結構；連結主詞與受詞之關係（即程序建立、登錄檔存取等系統操作）則採用 SecureBERT 進行編碼，善用其於資安語料上之預訓練成果以捕捉此類系統動作之自然語言語意。在結構階段，本研究建構溯源圖（provenance graph）以表徵系統實體間之時序與脈絡依賴關係，形成攻擊情境圖（Attack Scenario Graph, ASG）以進行行為序列建模。基於此結構化編碼（embedding），本論文進一步設計一套深度學習框架，用以偵測異常事件並將其對應至相應之 MITRE ATT&CK 技術。 此外，為因應「系統日誌變異性」（Event Log Variability）此一固有挑戰——即模型難以在使用不同實作工具、方法時辨識惡意活動——本研究整合一套 LLM 原生架構，對原始日誌資料執行高層次語意轉換，藉以穩健捕捉日誌檔案中之惡意意圖序列。 實驗結果顯示，該 LLM 原生架構顯著提升了對異質事件日誌（variate event logs）之偵測效果與行為可解釋性。研究結果說明，本論文所提出之框架能有效緩解資料稀缺問題並提升跨資料集偵測能力，使其高度適用於實務威脅獵捕（threat hunting）、事件調查（incident investigation）與具韌性之資安維運（security operations）。

In this thesis, a threat-informed detection framework leveraging both deep learning and Large Language Models (LLMs) is developed to identify, interpret, and generalize malicious or suspicious behaviors from Windows event logs. To address the challenges of scarce high-quality labeled data, insufficient behavioral annotation, and fragmented event context, this work employs MITRE Caldera and Atomic Red Team to conduct multi-stage adversary emulation experiments. These controlled activities generate high-fidelity logs spanning processes, file system operations, registry modifications, and network communications. Each event is mapped and annotated according to specific MITRE ATT&CK techniques, resulting in a reproducible, behavior-rich dataset that captures realistic adversarial activity. The proposed methodology integrates a multi-stage representation learning process with downstream deep learning and LLM-assisted classification models. In the semantic stage, each event is converted into a Subject–Relation–Object (S-R-O) structure, with each component encoded using a domain-specialized BERT model suited to its data type: command-line invocations are encoded using a model trained on large corpora of command-line data to capture attacker intent, file paths and registry keys are encoded using two additional self-trained models that learn the hierarchical structure of system artifacts, and relations—the operations connecting subjects and objects, such as process creation or registry access—are encoded using SecureBERT, leveraging its pretraining on cybersecurity corpora to capture the natural-language semantics of these system actions. In the structural stage, a provenance graph is constructed to represent temporal ordering and contextual dependencies among system entities, forming an Attack Scenario Graph (ASG) for behavioral sequence modeling. Building upon these structural embeddings, this thesis designs a deep learning framework capable of detecting anomalous events and mapping them to corresponding MITRE ATT&CK techniques. Furthermore, to address the inherent Event Logs Variability challenges where models fail to identify malicious activities using different implementation tools, an LLM native architecture is integrated to perform high-level semantic transformations of raw log data, robustly capturing the malicious intent sequences in the log file. Experimental results demonstrate that the LLM native architecture substantially improves variate event log detection and behavioral interpretability. The findings indicate that the proposed framework effectively mitigates data scarcity and cross-dataset detection, making it highly suited for practical threat hunting, incident investigation, and resilient security operations.