Network security researchers and practitioners constantly seek improved methods to manage and interpret vast amounts of network log data. The paper presents WireLlama, an Agentic Query system tailored for packet capture (PCAP) analysis. By leveraging the llama-agents and Scapy frameworks, WireLlama aims to enhance the capability of deriving insights from network traffic data. A pre-trained LLaMA model is utilized from Hugging Face for processing of user queries in natural language. These are translated into SQL and then the model then generates responses based on the SQL query and the preprocessed network data. The responses are also provided in natural language for easy comprehension by the user. As illustrated by results, the proposed system is successful in handling specific query functions, like identifying top IP addresses by traffic volume or detecting any suspicious activity.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

WireLlama - Agentic Query System for PCAP Analysis

  • Milind Choudhary,
  • Parmeet Kaur

摘要

Network security researchers and practitioners constantly seek improved methods to manage and interpret vast amounts of network log data. The paper presents WireLlama, an Agentic Query system tailored for packet capture (PCAP) analysis. By leveraging the llama-agents and Scapy frameworks, WireLlama aims to enhance the capability of deriving insights from network traffic data. A pre-trained LLaMA model is utilized from Hugging Face for processing of user queries in natural language. These are translated into SQL and then the model then generates responses based on the SQL query and the preprocessed network data. The responses are also provided in natural language for easy comprehension by the user. As illustrated by results, the proposed system is successful in handling specific query functions, like identifying top IP addresses by traffic volume or detecting any suspicious activity.