用大模型定位恶意软件中的反动态分析代码，提升逆向效率。
Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM
- 基于大语言模型分析二进制代码，定位反动态分析技术的实现位置。
- 在公开样本中成功识别87.8%的已知反分析代码段。
- 可帮助逆向工程师精准设置断点，适用于复杂恶意软件分析场景。
沙箱等动态分析手段在现代恶意软件检测系统中广泛应用，以提升对0日漏洞恶意软件的检测能力。因此，反动态分析（TADA）技术在当前恶意软件中广泛存在，导致沙箱可能出现误报和分析失败。此时人工逆向工程师需介入手动分析（如调试、打补丁），但同样受TADA干扰。本文提出一种基于大语言模型（LLM）的工作流，可精准定位代码中TADA的实现位置，辅助逆向工程师设置调试断点。评估显示，该方法成功识别了来自公开仓库的87.80%已知TADA实现；同时，在4个知名恶意软件样本中也成功定位了TADA位置，这些样本均见于在线恶意软件分析博客。
原文摘要 · Abstract (English)
Sandboxes and other dynamic analysis processes are prevalent in malware detection systems nowadays to enhance the capability of detecting 0-day malware. Therefore, techniques of anti-dynamic analysis (TADA) are prevalent in modern malware samples, and sandboxes can suffer from false negatives and analysis failures when analyzing the samples with TADAs. In such cases, human reverse engineers will get involved in conducting dynamic analysis manually (i.e., debugging, patching), which in turn also gets obstructed by TADAs. In this work, we propose a Large Language Model (LLM) based workflow that can pinpoint the location of the TADA implementation in the code, to help reverse engineers place breakpoints used in debugging. Our evaluation shows that we successfully identified the locations of 87.80% known TADA implementations adopted from public repositories. In addition, we successfully pinpoint the locations of TADAs in 4 well-known malware samples that are documented in online malware analysis blogs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。