SANS360 - 在数字取证与事件响应 (DFIR) 中使用 GenAI 的 5 个技巧.pdf

1、www.one-|www.ds4n6.io15 Tips for Using GenAI in DFIRwww.one-|ds4n6.io/aidfir.ioJess Garciaj3ssgarcia jess.garciaone-One eSecurity-Founder&LeaderSANS-Senior InstructorDS4N6/AIDFIR-Project leaderwww.one-|aidfir.io/ds4n6.io2Index1.TIP 1:Deploy your own LLM2.TIP 2:Local LLM for data anonymization3.TIP 3

2、:LLMs for scripting4.TIP 4:Malicious Code Analysis5.TIP 5:Data Analysis2www.one-|aidfir.io/ds4n6.io3TIP 1:Deploy Your Own LLM3What do you need?Open Source LLMsLLMs Serving Software3.2https:/ https:/ https:/ www.one-|aidfir.io/ds4n6.io4TIP 1:Deploy Your Own LLM4How to do it?(1)Install Ollama(2)Run th

3、e LLMhttps:/ curl-fsSL https:/ https:/ 2:Local LLM for Data Anonymization5What do you need?Local LLM RunningPrivate Data2025-03-15 14:32:10 trx_id=98af3c7b12 src=185.37.45.109 usr= card=4539678122450912 exp=07/27 cvv=*bank=BANCO_NACIONAL loc=ES-MADRID dev=iPhone13Pro os=iOS17.3 method=CONTACTLESS AU

4、TH SUCCESS-AMT=129.99EUR MERCHANT=TechStore Madrid-Electronics&Gadgets MCC=5732 term_id=TSM7839201 txn_type=POS ENTRY_MODE=CONTACTLESS prev_failed=2 last_failed=2025-03-14 20:15:43,2025-03-13 18:02:21 reason=INVALID_PIN fraud_check=PASSED risk_score=LOW auth_code=829473 2025-03-15 14:32:11 trx_id=98

5、af3c7b12 src=185.37.45.109 3.1https:/ www.one-|aidfir.io/ds4n6.io6TIP 2:Local LLM for Data Anonymization6(2)LLM Output(1)Design the PROMPTHow to do it?Giventhefollowingrawtransactionlog,anonymizeanysensitiveinformationwhilepreserving the original format.Specifically,mask:Credit card numbers.Email ad

6、dresses.IP addresses.Full names.Keep the structure and technical details intact,ensuring the log remains useful for analysis.event-logswww.one-|aidfir.io/ds4n6.io7TIP 3:LLMs for Scripting7What do you need?GenAI tool for code generationDesign the PROMPTWrite a script/tool/applicat