用对比学习优化大模型文本嵌入,提升恶意软件分类精度。
Semantic-Aware Contrastive Fine-Tuning: Boosting Multimodal Malware Classification with Discriminative Embeddings
- 基于余弦相似度筛选难负样本,增强文本嵌入区分能力。
- 仅用20个样本即达63.15%准确率,比基线高11-21个百分点。
- 生成带属性描述的泛化文本,适合少样本恶意软件分析。
恶意软件变种快速演进,亟需鲁棒的分类方法以增强网络安全。尽管大语言模型(LLMs)可生成恶意软件描述辅助家族分类,但其语义嵌入存在重叠且与二进制行为特征对齐不足。本文提出一种对比微调(CFT)方法,通过基于余弦相似度的硬负样本定向选择,优化LLM嵌入,使模型能区分密切相关的恶意软件家族。方法结合高相似度负样本以增强判别力,中等相似度负样本以提升嵌入多样性,兼顾精度与泛化性。在CIC-AndMal-2020和BODMAS数据集上评估,经微调的嵌入被集成至元学习框架(MAML)中的多模态分类器,在少样本设置下表现显著提升:于CIC-AndMal-2020上仅用20个样本即达63.15%准确率,优于基线11–21个百分点,超越先前负样本策略。消融实验表明,基于相似度的选择优于随机采样,提升达10–23%。此外,微调后的LLM生成具属性感知的描述,可泛化至未见变种,弥合文本与二进制特征差距。本工作推动了恶意软件分类的语义细化,并为适配大模型应对安全挑战提供可扩展框架。
原文摘要 · Abstract (English)
The rapid evolution of malware variants requires robust classification methods to enhance cybersecurity. While Large Language Models (LLMs) offer potential for generating malware descriptions to aid family classification, their utility is limited by semantic embedding overlaps and misalignment with binary behavioral features. We propose a contrastive fine-tuning (CFT) method that refines LLM embeddings via targeted selection of hard negative samples based on cosine similarity, enabling LLMs to distinguish between closely related malware families. Our approach combines high-similarity negatives to enhance discriminative power and mid-tier negatives to increase embedding diversity, optimizing both precision and generalization. Evaluated on the CIC-AndMal-2020 and BODMAS datasets, our refined embeddings are integrated into a multimodal classifier within a Model-Agnostic Meta-Learning (MAML) framework on a few-shot setting. Experiments demonstrate significant improvements: our method achieves 63.15% classification accuracy with as few as 20 samples on CIC-AndMal-2020, outperforming baselines by 11--21 percentage points and surpassing prior negative sampling strategies. Ablation studies confirm the superiority of similarity-based selection over random sampling, with gains of 10-23%. Additionally, fine-tuned LLMs generate attribute-aware descriptions that generalize to unseen variants, bridging textual and binary feature gaps. This work advances malware classification by enabling nuanced semantic distinctions and provides a scalable framework for adapting LLMs to cybersecurity challenges.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。