GPT-2C: A GPT-2 parser for Cowrie honeypot logs

TL;DR

This paper introduces GPT-2C, a system that uses a fine-tuned GPT-2 model to accurately parse dynamic logs from Cowrie SSH honeypots, improving interoperability with security tools.

Contribution

The paper presents a novel GPT-2 based parser specifically designed for dynamic honeypot logs, achieving high accuracy and real-time performance.

Findings

89% inference accuracy on honeypot logs

Effective parsing of dynamic user-generated content

Acceptable latency for real-time analysis

Abstract

Deception technologies like honeypots produce comprehensive log reports, but often lack interoperability with EDR and SIEM technologies. A key bottleneck is that existing information transformation plugins perform well on static logs (e.g. geolocation), but face limitations when it comes to parsing dynamic log topics (e.g. user-generated content). In this paper, we present a run-time system (GPT-2C) that leverages large pre-trained models (GPT-2) to parse dynamic logs generate by a Cowrie SSH honeypot. Our fine-tuned model achieves 89\% inference accuracy in the new domain and demonstrates acceptable execution latency.