Adaptive Cyber Analytics UI for Web Honeypot Logs Using LLMs
This guest diary by Eric Roldan, a SANS.edu student, introduces an innovative approach to cybersecurity analytics using Large Language Models (LLMs) to create adaptive user interfaces for web honeypot logs. Traditionally, security analysts spend significant time configuring tools and querying raw log data to identify attack patterns. This new system automates that process by ingesting DShield web honeypot logs, summarizing key metrics such as top IPs, URLs, and attack types via a Python analyzer, and then prompting an LLM (Claude) to generate a custom React dashboard component. The generated UI adapts dynamically to the specific nature of daily traffic, highlighting dominant attack campaigns or background noise accordingly. To ensure security, the system prevents the LLM from accessing raw malicious strings directly and renders the generated code within a sandboxed iframe, with fallback mechanisms for invalid code. This technology lowers the barrier to entry for threat detection, allowing users with limited cyber experience to effectively monitor web servers. The article demonstrates how bespoke AI-driven interfaces can shift focus from tool setup to actual threat analysis, enhancing defensive capabilities against varied web attacks like WordPress probes and path traversals.
Wire timeline
Adaptive Cyber Analytics UI for Web Honeypot Logs Using LLMs
This guest diary by Eric Roldan, a SANS.edu student, introduces an innovative approach to cybersecurity analytics using Large Language Models (LLMs) to create adaptive user interfaces for web honeypot logs. Traditionally, security analysts spend significant time configuring tools and querying raw log data to identify attack patterns. This new system automates that process by ingesting DShield web honeypot logs, summarizing key metrics such as top IPs, URLs, and attack types via a Python analyzer, and then prompting an LLM (Claude) to generate a custom React dashboard component. The generated UI adapts dynamically to the specific nature of daily traffic, highlighting dominant attack campaigns or background noise accordingly. To ensure security, the system prevents the LLM from accessing raw malicious strings directly and renders the generated code within a sandboxed iframe, with fallback mechanisms for invalid code. This technology lowers the barrier to entry for threat detection, allowing users with limited cyber experience to effectively monitor web servers. The article demonstrates how bespoke AI-driven interfaces can shift focus from tool setup to actual threat analysis, enhancing defensive capabilities against varied web attacks like WordPress probes and path traversals.
SANS Internet Storm Center, InfoCON: green