Leveraging Large Language Models for ATT&CK Technique Synthesis: Opportunities and Challenges
TL;DR
This paper investigates the use of LLMs developed with MITRE ATT&CK techniques to generate code snippets, implementation ideas, and descriptive summaries corresponding to ATT&CK techniques to assist security researchers, educators, penetration testers, and red teams in developing a better understanding of adversarial behavior and defensive strategy.
Abstract
The developing cybersecurity threats or large-scale attack vectors, coupled with the rising use of artificial intelligence (AI), are compelling researchers and practitioners to unite their forces in combating these issues through coordinated efforts. This paper investigates the use of LLMs developed with MITRE ATT&CK techniques, an established knowledge base that describes an adversary’s tactics, techniques and procedures based on real cyber operations. The experiment explores utilizing LLMs to generate code snippets, implementation ideas, and descriptive summaries corresponding to ATT&CK techniques to assist security researchers, educators, penetration testers, and red teams in developing a better understanding of adversarial behavior and defensive strategy. These abilities can enhance training, hasten security analyses, and create more credible evaluation testing grounds for detection and response mechanisms. Simultaneously, the availability of automated tools to code generators could raise a whole set of security issues, as they might lower the level of expertise required to replicate an offensive technique. Given these observations, careful governance, responsible application and proper safeguards ought to be exercised while applying LLMs in the domain of cybersecurity. By discussing the benefits and risks associated with LLMs, this paper attempts to present both sides of the coin in terms of the opportunities and challenges they present in relation to MITRE ATT&CK and modern cyber defences.