WireLlama - Agentic Query System for PCAP Analysis
摘要
Network security researchers and practitioners constantly seek improved methods to manage and interpret vast amounts of network log data. The paper presents WireLlama, an Agentic Query system tailored for packet capture (PCAP) analysis. By leveraging the llama-agents and Scapy frameworks, WireLlama aims to enhance the capability of deriving insights from network traffic data. A pre-trained LLaMA model is utilized from Hugging Face for processing of user queries in natural language. These are translated into SQL and then the model then generates responses based on the SQL query and the preprocessed network data. The responses are also provided in natural language for easy comprehension by the user. As illustrated by results, the proposed system is successful in handling specific query functions, like identifying top IP addresses by traffic volume or detecting any suspicious activity.