🤖 AI Summary
This work addresses the challenge of timely and accurate reporting of personal data breaches under the GDPR, which mandates notification within 72 hours—a process often hindered by the labor-intensive and error-prone manual translation of forensic evidence into structured compliance reports. To streamline this workflow, the authors propose a hybrid analysis method tailored for Linux/ARM-based data-exfiltrating malware, integrating static and dynamic analysis techniques. Crucially, they introduce a large language model (LLM) constrained by a formal JSON Schema to automatically map heterogeneous forensic artifacts onto regulatory reporting templates, such as Italy’s Garante notification form. This approach significantly reduces cognitive load on analysts while enhancing the completeness, regulatory compliance, and speed of incident response.
📝 Abstract
The General Data Protection Regulation (GDPR) requires organisations to notify supervisory authorities of personal data breaches within 72 hours of discovery. Meeting this strict deadline is challenging because incident responders must manually translate low-level forensic artefacts such as malware traces, system-call logs, and network captures into the structured, legally framed information required by data-protection authorities. This gap between technical evidence and regulatory reporting often results in delays, incomplete notifications, and a high cognitive burden on analysts. We propose a hybrid malware analysis pipeline that automates the extraction and organisation of breach-relevant information, with a particular focus on exfiltration-oriented Linux/ARM malware, which is rapidly increasing in prevalence due to the widespread adoption of IoT and embedded devices. The system combines static analysis to identify potential exfiltrators with dynamic analysis to reconstruct their behaviour. It employs a Large Language Model (LLM) constrained by a formal JSON schema aligned with the official Italian Garante Privacy notification form. The LLM transforms heterogeneous forensic artefacts into a structured, compliance-ready report that a human operator can rapidly validate.