RACONTEUR: A Knowledgeable, Insightful, and Portable LLM-Powered Shell Command Explainer

Malicious shell commands are linchpins to many cyber-attacks, but may not be easy to understand by security analysts due to complicated and often disguised code structures. Advances in large language models (LLMs) have unlocked the possibility of generating understandable explanations for shell commands. However, existing general-purpose LLMs suffer from a lack of expert knowledge and a tendency to hallucinate in the task of shell command explanation. In this paper, we present RACONTEUR, a knowledgeable, expressive and portable shell command explainer powered by LLM. RACONTEUR is infused with professional knowledge to provide comprehensive explanations on shell commands, including not only what the command does (i.e., behavior) but also why the command does it (i.e., purpose). To shed light on the high-level intent of the command, we also translate the natural-language-based explanation into standard technique & tactic defined by MITRE ATT&CK, the worldwide knowledge base of cybersecurity. To enable RACONTEUR to explain unseen private commands, we further develop a documentation retriever to obtain relevant information from complementary documentations to assist the explanation process. We have created a largescale dataset for training and conducted extensive experiments to evaluate the capability of RACONTEUR in shell command explanation. The experiments verify that RACONTEUR is able to provide high-quality explanations and in-depth insight of the intent of the command.

• We propose RACONTEUR, an LLM-powered shell command explainer that can provide knowledgeable and insightful descriptions on shell commands, especially malicious ones, to assist security analysts in identifying potential cyber-attacks.

• We equip RACONTEUR with a holistic toolkit including behavior explainer, intent identifier, and documentation retriever, allowing RACONTEUR to provide comprehensive and faithful explanations on public and private shell commands.

• We have conducted extensive experiments to verify that RACONTEUR is able to provide high-quality explanations and in-depth insight of the intent of the command. The dataset we curated is open-source to boost further research in LLM-aided code explanation 1 .