RACONTEUR: A Knowledgeable, Insightful, and Portable LLM-Powered Shell Command Explainer
Jiangyi Deng (1), Xinfeng Li (1), Yanjiao Chen (1), Yijie Bai (1),, Haiqin Weng (2), Yan Liu (2), Tao Wei (2), Wenyuan Xu (1) ((1) Zhejiang, University, (2) Ant Group)

TL;DR
Raconteur is an LLM-powered shell command explainer that integrates expert knowledge, translates explanations into cybersecurity tactics, and uses documentation retrieval to explain unseen commands, enhancing security analysis.
Contribution
The paper introduces Raconteur, a knowledgeable and portable shell command explainer that combines expert knowledge, tactic translation, and documentation retrieval to improve understanding of malicious commands.
Findings
Raconteur provides high-quality, in-depth explanations of shell commands.
It effectively translates command intent into MITRE ATT&CK tactics.
Experiments show Raconteur outperforms baseline models in explanation accuracy.
Abstract
Malicious shell commands are linchpins to many cyber-attacks, but may not be easy to understand by security analysts due to complicated and often disguised code structures. Advances in large language models (LLMs) have unlocked the possibility of generating understandable explanations for shell commands. However, existing general-purpose LLMs suffer from a lack of expert knowledge and a tendency to hallucinate in the task of shell command explanation. In this paper, we present Raconteur, a knowledgeable, expressive and portable shell command explainer powered by LLM. Raconteur is infused with professional knowledge to provide comprehensive explanations on shell commands, including not only what the command does (i.e., behavior) but also why the command does it (i.e., purpose). To shed light on the high-level intent of the command, we also translate the natural-language-based explanation…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Data Processing Techniques · Oil and Gas Production Techniques · Software System Performance and Reliability
MethodsBalanced Selection
