用大模型自动生成恶意软件规则，提升开源生态安全防护效率
Automatically Generating Rules of Malicious Software Packages via Large Language Model
- 基于大模型分析恶意包的元数据与代码，自动生成YARA和Semgrep规则
- 在1633个恶意包上生成763条规则，准确率85.2%，召回率91.8%
- 规则分类体系涵盖11类38子类，适合安全研究人员与DevSecOps团队
当前安全工具主要依赖专家手工编写的预定义规则，难以应对软件供应链攻击的快速演化。为此，我们提出一种新工具RuleLLM，利用大语言模型（LLMs）自动化生成开源软件生态中的检测规则。RuleLLM从恶意软件中提取元数据和代码片段作为输入，生成可直接部署于开发流程的YARA和Semgrep规则。规则生成任务包含三个子任务：规则构建、规则优化与规则对齐。我们实现了一个原型系统，并在包含1,633个恶意包的数据集上进行实验。结果表明，RuleLLM共生成763条规则（其中452条为YARA，311条为Semgrep），精确率为85.2%，召回率为91.8%，优于现有最先进工具和基于评分的方法。此外，我们对生成规则进行了分析，提出了一个包含11个类别和38个子类的规则分类体系。
原文摘要 · Abstract (English)
Today's security tools predominantly rely on predefined rules crafted by experts, making them poorly adapted to the emergence of software supply chain attacks. To tackle this limitation, we propose a novel tool, RuleLLM, which leverages large language models (LLMs) to automate rule generation for OSS ecosystems. RuleLLM extracts metadata and code snippets from malware as its input, producing YARA and Semgrep rules that can be directly deployed in software development. Specifically, the rule generation task involves three subtasks: crafting rules, refining rules, and aligning rules. To validate RuleLLM's effectiveness, we implemented a prototype system and conducted experiments on the dataset of 1,633 malicious packages. The results are promising that RuleLLM generated 763 rules (452 YARA and 311 Semgrep) with a precision of 85.2\% and a recall of 91.8\%, outperforming state-of-the-art (SOTA) tools and scored-based approaches. We further analyzed generated rules and proposed a rule taxonomy: 11 categories and 38 subcategories.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。