[Paper Review] SEvenLLM: Benchmarking, Eliciting, and Enhancing Abilities of Large Language Models in Cyber Threat Intelligence

Hangyuan Ji, Jian Yang+10 more|arXiv (Cornell University)|May 6, 2024

Topic Modeling4 citations

TL;DR

This paper introduces SEvenLLM, a framework that benchmarks, elicits, and enhances large language models (LLMs) for cyber threat intelligence (CTI) by creating a high-quality bilingual (English/Chinese) instruction dataset, SEvenLLM-Instruct, through LLM-automated task selection and human refinement. Fine-tuned on 28 multi-task objectives, SEvenLLM outperforms general LLMs like GPT-3.5 in threat analysis and response, validated via the curated SEvenLLM-Bench benchmark, demonstrating superior performance in real-world cybersecurity incident understanding and response.

ABSTRACT

To address the increasing complexity and frequency of cybersecurity incidents emphasized by the recent cybersecurity threat reports with over 10 billion instances, cyber threat intelligence (CTI) plays a critical role in the modern cybersecurity landscape by offering the insights required to understand and combat the constantly evolving nature of cyber threats. Inspired by the powerful capability of large language models (LLMs) in handling complex tasks, in this paper, we introduce a framework to benchmark, elicit, and improve cybersecurity incident analysis and response abilities in LLMs for Security Events (SEvenLLM). Specifically, we create a high-quality bilingual instruction corpus by crawling cybersecurity raw text from cybersecurity websites to overcome the lack of effective data for information extraction. Then, we design a pipeline to auto-select tasks from the tasks pool and convert the raw text into supervised corpora comprised of question and response. The instruction dataset SEvenLLM-Instruct is used to train cybersecurity LLMs with the multi-task learning objective (27 well-designed tasks) for augmenting the analysis of cybersecurity events. Extensive experiments in our curated benchmark (SEvenLLM-bench) demonstrate that SEvenLLM performs more sophisticated threat analysis and fortifies defenses against the evolving landscape of cyber threats.

Motivation & Objective

• Address the scarcity of high-quality, task-specific datasets for cyber threat intelligence (CTI) in LLM training.
• Improve the ability of LLMs to analyze and respond to cybersecurity incidents through domain-specific instruction tuning.
• Develop a comprehensive evaluation benchmark to assess LLM performance in CTI tasks, bridging the gap between general and security-specific capabilities.
• Enable automated, accurate, and professional threat analysis by reducing reliance on human expertise through fine-tuned, open-source LLMs.
• Establish a scalable pipeline for constructing instruction datasets from raw cybersecurity reports using LLMs and expert validation.

Proposed method

• Crawled raw cybersecurity incident reports from public sources to build a bilingual (English/Chinese) corpus of cybersecurity texts.
• Used GPT-4 to generate candidate tasks from the raw texts, which were then refined by human experts based on MITRE ATT&CK and OASIS CTI TC standards to form a task pool.
• Implemented a Select-Instruct pipeline to automatically select the most relevant task from the pool and generate corresponding question-answer pairs for supervised fine-tuning.
• Constructed the SEvenLLM-Instruct dataset comprising 28 well-designed, multi-task instruction examples for training domain-specific LLMs.
• Fine-tuned open-source LLMs (Llama and Qwen) on SEvenLLM-Instruct using multi-task learning objectives to enhance CTI-specific capabilities.
• Built the SEvenLLM-Bench evaluation benchmark with multiple-choice and query-answer questions to comprehensively assess model performance in cybersecurity contexts.

Experimental results

Research questions

• RQ1 Can a self-supervised, LLM-aided data construction pipeline effectively generate high-quality, task-specific instruction data for cyber threat intelligence?
• RQ2 To what extent can multi-task fine-tuning on a curated instruction dataset improve LLMs' performance in analyzing and responding to cybersecurity incidents compared to general-purpose LLMs?
• RQ3 How does the performance of SEvenLLM compare to strong baselines like GPT-3.5 in real-world CTI tasks, particularly in terms of completeness and professionalism of responses?
• RQ4 Can a benchmark like SEvenLLM-Bench effectively evaluate and differentiate the capabilities of LLMs in cyber threat intelligence scenarios?
• RQ5 What impact does bilingual (English/Chinese) data curation have on the generalization and practical utility of CTI-focused LLMs?

Key findings

• SEvenLLM, fine-tuned on the SEvenLLM-Instruct dataset, produces more complete and professional responses in cyber threat analysis than GPT-3.5, despite having fewer parameters.
• The SEvenLLM-Bench benchmark successfully evaluates LLMs across diverse CTI tasks, providing a standardized and comprehensive evaluation framework.
• The multi-task learning objective on 28 well-designed tasks significantly enhances the analytical and response capabilities of LLMs in cybersecurity incident contexts.
• The Select-Instruct pipeline effectively automates the creation of high-quality, human-validated instruction data from raw cybersecurity reports, ensuring relevance and practicality.
• The bilingual (English/Chinese) instruction dataset improves the model's applicability in multilingual cybersecurity environments, though multilingual expansion remains a future direction.
• The framework demonstrates strong generalization and robustness in threat intelligence tasks, reducing reliance on expert labor in incident analysis.