End-point monitoring solutions are widely deployed in today's enterprise environments to support advanced attack detection and investigation. These monitors continuously record system-level activities as audit logs and provide deep visibility into security events. Unfortunately, existing methods of semantic analysis based on audit logs have low granularity, only reaching the system call level, making it difficult to effectively classify highly covert behaviors. Additionally, existing works mainly match audit log streams with rule knowledge bases describing behaviors, which heavily rely on expertise and lack the ability to detect unknown attacks and provide interpretive descriptions. In this paper, we propose SmartGuard, an automated method that combines abstracted behaviors from audit event semantics with large language models. SmartGuard extracts specific behaviors (function level) from incoming system logs and constructs a knowledge graph, divides events by threads, and combines event summaries with graph embeddings to achieve information diagnosis and provide explanatory narratives through large language models. Our evaluation shows that SmartGuard achieves an average F1 score of 96\% in assessing malicious behaviors and demonstrates good scalability across multiple models and unknown attacks. It also possesses excellent fine-tuning capabilities, allowing experts to assist in timely system updates.

翻译：端点监控解决方案在当今企业环境中被广泛部署，以支持高级攻击检测与调查。这些监控器持续记录系统级活动作为审计日志，并为安全事件提供深度可见性。然而，现有基于审计日志的语义分析方法粒度较低，仅达到系统调用级别，难以有效分类高度隐蔽的行为。此外，现有工作主要将审计日志流与描述行为的规则知识库进行匹配，这种方法严重依赖专家知识，缺乏检测未知攻击及提供解释性描述的能力。本文提出SmartGuard，一种将审计事件语义中的抽象行为与大语言模型相结合的自动化方法。SmartGuard从传入的系统日志中提取特定行为（函数级别）并构建知识图谱，按线程划分事件，通过将事件摘要与图嵌入相结合来实现信息诊断，并借助大语言模型提供解释性叙述。评估结果表明，SmartGuard在评估恶意行为时平均F1分数达到96%，并在多种模型和未知攻击场景中展现出良好的可扩展性。同时，该方法具备优秀的微调能力，使专家能够协助系统及时更新。