标题： SHIELD：使用大语言模型的高级持续性威胁检测与智能解释 显示英文标题

标题： SHIELD: APT Detection and Intelligent Explanation Using LLM

摘要： 高级持续性威胁（APTs）是复杂的网络攻击，可以在长时间内不被发现，使其缓解特别具有挑战性。 由于其持续性，需要大量努力来检测它们并做出有效的响应。 现有的基于溯源的攻击检测方法通常缺乏可解释性，并且存在较高的误报率，而调查方法要么是监督的，要么仅限于已知的攻击。 为了解决这些挑战，我们引入了SHIELD，这是一种结合统计异常检测和基于图的分析与大型语言模型（LLMs）上下文分析能力的新方法。 SHIELD利用LLMs的隐含知识，在溯源数据中发现隐藏的攻击模式，同时减少误报并提供清晰、可解释的攻击描述。 这减少了分析人员的警报疲劳，并使他们更容易理解威胁环境。 我们的广泛评估证明了SHIELD在现实场景中的有效性和计算效率。 SHIELD被证明优于最先进的方法，实现了更高的精确率和召回率。 SHIELD将异常检测、LLM驱动的上下文分析和先进的基于图的相关性相结合，为APT检测建立了新的基准。 显示英文摘要

摘要： Advanced persistent threats (APTs) are sophisticated cyber attacks that can remain undetected for extended periods, making their mitigation particularly challenging. Given their persistence, significant effort is required to detect them and respond effectively. Existing provenance-based attack detection methods often lack interpretability and suffer from high false positive rates, while investigation approaches are either supervised or limited to known attacks. To address these challenges, we introduce SHIELD, a novel approach that combines statistical anomaly detection and graph-based analysis with the contextual analysis capabilities of large language models (LLMs). SHIELD leverages the implicit knowledge of LLMs to uncover hidden attack patterns in provenance data, while reducing false positives and providing clear, interpretable attack descriptions. This reduces analysts' alert fatigue and makes it easier for them to understand the threat landscape. Our extensive evaluation demonstrates SHIELD's effectiveness and computational efficiency in real-world scenarios. SHIELD was shown to outperform state-of-the-art methods, achieving higher precision and recall. SHIELD's integration of anomaly detection, LLM-driven contextual analysis, and advanced graph-based correlation establishes a new benchmark for APT detection.