Unknown web attack threat detection based on large language model

Unknown attacks pose a significant threat to current cyber defenses. Traditional methods for detecting abnormal user behaviors rely on explicit associations and content information, often overlooking implicit causal relationships. Additionally, the frequent emergence of new attack types and the scarcity of training data limit their effectiveness. The paper proposes a novel approach for detecting abnormal user behaviors using large language models (LLMs), addressing these challenges under low-resource conditions. Our method extracts implicit causal relationships from system logs to build behavior graphs and employs label-free graph contrastive invariant learning to generate causal feature vectors. A multi-agent framework, including narrator and decision- maker agents, is used to improve descriptive text generation, while the Translator more efficiently converts causal vectors into meaningful descriptions. Experimental results on the WAB-dataset demonstrate that implicit causal relationships enhance the graph structure's ability to represent abnormal behaviors. The integration of LLMs enables superior behavior analysis with fewer resources compared to traditional methods. Additionally, the comprehensibility of the generated texts and the efficiency of the Translator provide a strong foundation for supporting security professionals in understanding and analyzing abnormal behaviors in real-world scenarios.