Abstract:

[Objective] This paper summarizes the research progress of language models for proactive threat hunting driven by data, and provides technical foresight for the detection and source tracing of advanced threats. [Methods] This study combines the frontier academic and industrial progress of cyber security, introduces and summarizes related research from multiple levels such as the evaluation metric construction for threat hunting, the fusion of multi-modal, multi-dimensional, and multi-source data, the dependency explosion mitigation and analysis, and finally the modeling of multi-modal threat hunting language. [Results] Combining the key requirements of threat hunting and related technology trends, the supported data types, model types, modeling methods, timeliness, and other dimensions of the research status and future works of data-driven threat hunting and language models are comprehensively summarized. [Conclusions] In the face of threat detection and forensic scenarios for adversarial APT attacks, on one hand, it is necessary to build a multi-source heterogeneous fusion data infrastructure and solve the problem of data dependence explosion. On the other hand, it is still necessary to explore standardized and flexible language models to support the unified analysis of multi-modal, multi-source, and multi-dimensional data.

Key words: threat hunting, security operations, advanced persistent threats