“Towards Automatic Triage and Taxonomy of Adversary Shell-Scripts”, by Jared Chandler, tackles a growing bottleneck in cyber-threat intelligence. Security professionals identify attacks and produce threat intelligence feeds through manual analysis of system and network data, but this process is time-consuming and is difficult to scale with the growing volume of raw threat data.
The author circumvents this bottleneck by using large language models to perform unsupervised triage and taxonomy of raw cyber-threat intelligence data. This approach clusters malicious shell-scripts using both direct and LLM-generated script summary vector embeddings, then automatically re-summarizes these clusters (using an LLM) to produce an overview a human analyst can then read. This method reliably recovered ground-truth categories, showing that high-quality attack taxonomies can be created automatically.
To learn more, read the paper. To receive notification of SPLICE news, subscribe to this blog!
Chandler, J. (2025). Towards Automatic Triage and Taxonomy of Adversary Shell-Scripts. Annual Computer Security Applications Conference Workshops (ACSAC Workshops), 428–435. https://doi.org/10.1109/ACSACW69556.2025.00053
SPLICE 
Leave a comment