CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research

Sian-Yao Huang, Cheng-Lin Yang, Che-Yu Lin, Chun-Ying Huang


Abstract
This research addresses command-line embedding in cybersecurity, a field obstructed by the lack of comprehensive datasets due to privacy and regulation concerns. We propose the first dataset of similar command lines, named CyPHER, for training and unbiased evaluation. The training set is generated using a set of large language models (LLMs) comprising 28,520 similar command-line pairs. Our testing dataset consists of 2,807 similar command-line pairs sourced from authentic command-line data.In addition, we propose a command-line embedding model named CmdCaliper, enabling the computation of semantic similarity with command lines. Performance evaluations demonstrate that the smallest version of CmdCaliper (30 million parameters) suppresses state-of-the-art (SOTA) sentence embedding models with ten times more parameters across various tasks (e.g., malicious command-line detection and similar command-line retrieval).Our study explores the feasibility of data generation using LLMs in the cybersecurity domain. Furthermore, we release our proposed command-line dataset, embedding models’ weights and all program codes to the public. This advancement paves the way for more effective command-line embedding for future researchers.
Anthology ID:
2024.emnlp-main.1126
Volume:
Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing
Month:
November
Year:
2024
Address:
Miami, Florida, USA
Editors:
Yaser Al-Onaizan, Mohit Bansal, Yun-Nung Chen
Venue:
EMNLP
SIG:
Publisher:
Association for Computational Linguistics
Note:
Pages:
20188–20206
Language:
URL:
https://aclanthology.org/2024.emnlp-main.1126
DOI:
Bibkey:
Cite (ACL):
Sian-Yao Huang, Cheng-Lin Yang, Che-Yu Lin, and Chun-Ying Huang. 2024. CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 20188–20206, Miami, Florida, USA. Association for Computational Linguistics.
Cite (Informal):
CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research (Huang et al., EMNLP 2024)
Copy Citation:
PDF:
https://aclanthology.org/2024.emnlp-main.1126.pdf
Software:
 2024.emnlp-main.1126.software.zip
Data:
 2024.emnlp-main.1126.data.zip