The collection of security-related logs holds the key to understanding attack
behaviors and diagnosing vulnerabilities. Still, their analysis remains a
daunting challenge. Recently, Language Models (LMs) have demonstrated unmatched
potential in understanding natural and programming languages. The question
arises whether and how LMs could be also useful for security experts since
their logs contain intrinsically confused and obfuscated information. In this
paper, we systematically study how to benefit from the state-of-the-art in LM
to automatically analyze text-like Unix shell attack logs. We present a
thorough design methodology that leads to LogPr\'ecis. It receives as input raw
shell sessions and automatically identifies and assigns the attacker tactic to
each portion of the session, i.e., unveiling the sequence of the attacker's
goals. We demonstrate LogPr\'ecis capability to support the analysis of two
large datasets containing about 400,000 unique Unix shell attacks. LogPr\'ecis
reduces them into about 3,000 fingerprints, each grouping sessions with the
same sequence of tactics. The abstraction it provides lets the analyst better
understand attacks, identify fingerprints, detect novelty, link similar
attacks, and track families and mutations. Overall, LogPr\'ecis, released as
open source, paves the way for better and more responsive defense against
cyberattacks.

本论文介绍了一种系统方法，LogPr'écis，用于自动化分析类似文本的 Unix shell 攻击日志，并演示了它对两个包含约 400,000 个唯一 Unix shell 攻击的大型数据集的支持能力。