用语言模型分析NVMe命令流，提升勒索软件检测精度
Learning the Language of NVMe Streams for Ransomware Detection
- 将变压器模型用于命令序列的上下文分类
- 比现有方法降低24%漏检率，提升84%数据访问识别率
- 适合安全研究者和系统防护工程师参考
我们应用语言建模技术检测NVMe命令序列中的勒索软件活动。设计并训练了两种基于Transformer的模型：命令级Transformer（CLT）通过上下文标记分类判断单个命令是否由勒索软件发起；补丁级Transformer（PLT）预测命令片段中勒索软件访问的数据量。本文提出相应的分词与嵌入方案，结果显示，相比最先进的表格方法，该方法在漏检率上最多降低24%，数据防泄漏能力提升66%，对勒索软件访问数据的识别率提高84%。
原文摘要 · Abstract (English)
We apply language modeling techniques to detect ransomware activity in NVMe command sequences. We design and train two types of transformer-based models: the Command-Level Transformer (CLT) performs in-context token classification to determine whether individual commands are initiated by ransomware, and the Patch-Level Transformer (PLT) predicts the volume of data accessed by ransomware within a patch of commands. We present both model designs and the corresponding tokenization and embedding schemes and show that they improve over state-of-the-art tabular methods by up to 24% in missed-detection rate, 66% in data loss prevention, and 84% in identifying data accessed by ransomware.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。