用大模型检测恶意域名，效果优于传统方法。
LLMs for Domain Generation Algorithm Detection
- 采用微调和上下文学习两种策略提升检测能力。
- 微调后模型准确率达94%，误报率仅4%。
- 适合安全研究者和反病毒团队快速应对新威胁。
本文研究大语言模型（LLMs）在域名生成算法（DGAs）检测中的应用。通过详细评估上下文学习（ICL）与监督微调（SFT）两种技术，发现SFT利用领域数据可显著提升性能，而ICL使模型无需大量重训即可快速适应新威胁。实验基于Meta的Llama3 8B模型，在包含68个恶意家族与正常域名的自定义数据集上进行，涵盖多种难以检测的方案，包括近期的基于单词的DGAs。结果表明，基于LLM的方法可实现有竞争力的检测效果；其中，SFT-based模型准确率达94%，误报率（FPR）为4%，在识别基于单词的DGA域名方面表现尤为突出，超越现有使用注意力机制的先进模型。
原文摘要 · Abstract (English)
This work analyzes the use of large language models (LLMs) for detecting domain generation algorithms (DGAs). We perform a detailed evaluation of two important techniques: In-Context Learning (ICL) and Supervised Fine-Tuning (SFT), showing how they can improve detection. SFT increases performance by using domain-specific data, whereas ICL helps the detection model to quickly adapt to new threats without requiring much retraining. We use Meta's Llama3 8B model, on a custom dataset with 68 malware families and normal domains, covering several hard-to-detect schemes, including recent word-based DGAs. Results proved that LLM-based methods can achieve competitive results in DGA detection. In particular, the SFT-based LLM DGA detector outperforms state-of-the-art models using attention layers, achieving 94% accuracy with a 4% false positive rate (FPR) and excelling at detecting word-based DGA domains.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。