用并行提取指令特征+GPU加速，快速识别恶意软件所属的高级持续性威胁组。
Scalable APT Malware Classification via Parallel Feature Extraction and GPU-Accelerated Learning
- 通过并行化脚本批量分析可执行文件的汇编指令（操作码）
- 采用CNN模型结合GPU加速，在无元数据时仍实现高效分类
- 适合需要大规模自动化威胁情报分析的安全团队
本文提出一种用于自动且加速恶意软件分类的框架，具体将恶意可执行文件映射到已知的高级持续性威胁（APT）组织。核心特征来自可执行文件中的汇编级指令（即操作码）。由于大量恶意样本的操作码收集耗时，研究结合开源逆向工程工具与并行计算脚本，实现多文件同时分析。构建了一元组和二元组数据集，训练SVM、KNN和决策树等传统模型；但这些模型在缺乏元数据支持时表现不佳。通过使用卷积神经网络（CNN）并借助图形处理单元（GPU）资源大幅加速计算，有效克服了传统模型的性能瓶颈。
原文摘要 · Abstract (English)
This paper presents an underlying framework for both automating and accelerating malware classification, more specifically, mapping malicious executables to known Advanced Persistent Threat (APT) groups. The main feature of this analysis is the assembly-level instructions present in executables which are also known as opcodes. The collection of such opcodes on many malicious samples is a lengthy process; hence, open-source reverse engineering tools are used in tandem with scripts that leverage parallel computing to analyze multiple files at once. Traditional and deep learning models are applied to create models capable of classifying malware samples. One-gram and two-gram datasets are constructed and used to train models such as SVM, KNN, and Decision Tree; however, they struggle to provide adequate results without relying on metadata to support n-gram sequences. The computational limitations of such models are overcome with convolutional neural networks (CNNs) and heavily accelerated using graphical compute unit (GPU) resources.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。