Hackphyr：用于网络安全环境的本地微调LLM代理

Hackphyr: A Local Fine-Tuned LLM Agent for Network Security Environments

September 17, 2024

作者: Maria Rigaki, Carlos Catania, Sebastian Garcia

cs.AI

摘要

大型语言模型（LLMs）展现出在各个领域的显著潜力，包括网络安全。使用商业云端的LLMs可能存在隐私问题、成本和网络连接限制，这是不理想的。本文介绍了Hackphyr，这是一个在网络安全环境中作为红队代理使用的本地微调LLM。我们微调的70亿参数模型可以在单个GPU卡上运行，并且达到了与更大更强大的商业模型（如GPT-4）相媲美的性能。Hackphyr明显优于其他模型，包括GPT-3.5-turbo和基线模型，如Q学习代理在复杂、以前未见的场景中。为了实现这一性能，我们生成了一个新的任务特定的网络安全数据集，以增强基础模型的能力。最后，我们对代理的行为进行了全面分析，从而深入了解这些代理的规划能力和潜在缺陷，有助于更广泛地理解基于LLM的代理在网络安全环境中的应用。

English

Large Language Models (LLMs) have shown remarkable potential across various domains, including cybersecurity. Using commercial cloud-based LLMs may be undesirable due to privacy concerns, costs, and network connectivity constraints. In this paper, we present Hackphyr, a locally fine-tuned LLM to be used as a red-team agent within network security environments. Our fine-tuned 7 billion parameter model can run on a single GPU card and achieves performance comparable with much larger and more powerful commercial models such as GPT-4. Hackphyr clearly outperforms other models, including GPT-3.5-turbo, and baselines, such as Q-learning agents in complex, previously unseen scenarios. To achieve this performance, we generated a new task-specific cybersecurity dataset to enhance the base model's capabilities. Finally, we conducted a comprehensive analysis of the agents' behaviors that provides insights into the planning abilities and potential shortcomings of such agents, contributing to the broader understanding of LLM-based agents in cybersecurity contexts