Towards Establishing the Role of LLMs in Botnet Detection: Effective Prompts for Source Code Analysis

Botnets have long posed a significant threat to the internet for multiple reasons. As tools for combating this threat have improved, so have the tactics of malicious actors, who continually enhance their means of obfuscation and deception. The emergence of large language models (LLMs) has opened new avenues for machines to analyze and generate human-readable text. This advancement also extends to the generation of executable code, providing cybersecurity researchers and professionals with the opportunity to employ these models in combating cyber threats. However, these capabilities are also available to malicious actors. As we move towards more effective detection and classification techniques, this paper explores the potential of LLMs to classify Python and C++ code as botnet-related or not. We also introduce a unique dataset to test the capabilities of large language models. In an effort to establish the role of LLMs in the botnet detection landscape, this initial study evaluates how the most advanced model to date, ChatGPT-4, performs on source code at various levels of obfuscation and prompt types.