Detection of command and control frameworks through LLM: a proof of concept

Details

Supervisors

Mens, Kim ; Legay, Axel

Faculty

Ecole polytechnique de Louvain

Degree label

Master [120] en sciences informatiques, à finalité spécialisée

Abstract

Detecting modern Command and Control (C2) frameworks is increasingly challenging, as attackers adopt encryption, obfuscation, and living-off-the-land techniques to evade traditional detection. Signature- and rule-based systems like Snort or Suricata often struggle to keep up, requiring constant updates and manual tuning to remain effective. This Master’s thesis explores whether Large Language Models (LLMs) can offer a more adaptive alternative. Specifically, it investigates the use of general-purpose LLMs to detect and classify C2 activity based on network traffic and C2-related documentation, without relying on predefined signatures or retraining. The proposed method provides the LLM with structured network traces and C2 documentation, and asks it to determine whether the trace indicates C2 behavior, and if so, which framework is involved. The model also produces a natural language explanation of its reasoning. Detection and classification performance are evaluated using standard metrics such as Precision, Recall, and F1-score. For the reasoning component, semantic quality is assessed using BERTScore. Results show strong detection performance, with an F1-score exceeding 80 % on a dataset of 537 test samples. Classification yielded a macro F1-score around 60 %, with a weighted precision above 70 %. This study demonstrates that off-the-shelf LLMs, when guided with prompt engineering, can effectively support the detection and attribution of C2 framework activity, without the need for model retraining or handcrafted rules.