Intrusion Detection Systems (IDS) are a proven approach to secure networks. However, in a privately used network, it is difficult for users without cybersecurity expertise to understand IDS alerts, and to respond in time with adequate measures. This puts the security of home networks, smart home installations, home-office workers, etc. at risk, even if an IDS is correctly installed and configured. In this work, we propose ChatIDS, our approach to explain IDS alerts to non-experts by using large language models. We evaluate the feasibility of ChatIDS by using ChatGPT, and we identify open research issues with the help of interdisciplinary experts in artificial intelligence. Our results show that ChatIDS has the potential to increase network security by proposing meaningful security measures in an intuitive language from IDS alerts. Nevertheless, some potential issues in areas such as trust, privacy, ethics, etc. need to be resolved, before ChatIDS might be put into practice.
翻译:摘要:入侵检测系统(IDS)是保障网络安全的成熟方案。然而,在私有网络中,缺乏网络安全专业知识的用户难以理解IDS警报并及时采取适当应对措施。即便IDS正确安装配置,家庭网络、智能家居设备、居家办公等场景的安全仍面临风险。本文提出ChatIDS方法,通过利用大语言模型向非专业用户解释IDS警报。我们借助ChatGPT评估了ChatIDS的可行性,并联合人工智能领域跨学科专家识别出若干开放研究问题。结果表明,ChatIDS能够从IDS警报中提炼出以直观语言表述的切实安全措施,具有增强网络安全的潜力。然而,在ChatIDS实际部署前,仍需解决信任、隐私、伦理等领域的潜在问题。