Hackphyr: A Local Fine-Tuned LLM Agent for Network Security Environments

Maria Rigaki,Carlos Catania,Sebastian Garcia

2024-09-17

Abstract:Large Language Models (LLMs) have shown remarkable potential across various domains, including cybersecurity. Using commercial cloud-based LLMs may be undesirable due to privacy concerns, costs, and network connectivity constraints. In this paper, we present Hackphyr, a locally fine-tuned LLM to be used as a red-team agent within network security environments. Our fine-tuned 7 billion parameter model can run on a single GPU card and achieves performance comparable with much larger and more powerful commercial models such as GPT-4. Hackphyr clearly outperforms other models, including GPT-3.5-turbo, and baselines, such as Q-learning agents in complex, previously unseen scenarios. To achieve this performance, we generated a new task-specific cybersecurity dataset to enhance the base model's capabilities. Finally, we conducted a comprehensive analysis of the agents' behaviors that provides insights into the planning abilities and potential shortcomings of such agents, contributing to the broader understanding of LLM-based agents in cybersecurity contexts

Cryptography and Security

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the key challenges faced when using large - language models (LLMs) as red - team agents in the network security environment. Specifically, the paper focuses on the following points:

1. **Privacy and Cost Issues**: Although LLMs in commercial cloud services are powerful, using these services may bring the risk of privacy leakage and are relatively costly. In addition, network - connection limitations also affect their application in practical environments.

2. **Performance and Adaptability**: Although existing LLMs perform well on many tasks, in complex tasks in specific fields, such as red - team operations in network security, their performance and adaptability still need to be improved. In particular, when dealing with unseen scenarios, the performance of existing models is often not satisfactory.

3. **Lack of Datasets**: In order to improve the performance of LLMs in specific fields, specialized datasets are required to fine - tune them. However, high - quality datasets for the network - security field are relatively scarce.

To solve the above problems, the paper proposes a locally fine - tuned LLM named Hackphyr, which is designed to be a red - team agent in the network environment. By generating new task - specific datasets and conducting supervised fine - tuning, Hackphyr can be comparable in performance to larger - scale commercial models and even perform better in some complex scenarios. In addition, the paper also conducts a detailed analysis of the behaviors of different agents to evaluate their planning capabilities and similarities to human behaviors.