用专家知识生成可解释的恶意软件语义报告，提升AI分析效果
Semantic Preprocessing for LLM-based Malware Analysis
- 将静态与行为分析特征融合，生成带威胁框架标签的JSON报告
- 在真实数据集上使大模型分类F1得分达0.94，显著提升可解释性
- 适合安全研究人员和需高可信度分析的场景
在恶意软件分析领域，众多基于人工智能的方法侧重于图像或序列数据处理，却忽略了专家视角。针对此问题，本文提出一种聚焦专家知识的预处理方法，为可移植执行文件生成结构化JSON报告。该报告整合了静态与行为分析特征，并引入打包器签名检测、MITRE ATT&CK与恶意软件行为目录（MBC）知识，旨在构建可被安全分析师理解的二进制文件语义表示，增强AI模型对恶意文件分析的可解释性。利用该预处理数据训练大型语言模型进行恶意软件分类，在代表市场现实的复杂数据集上，达到加权平均F1分数0.94。
原文摘要 · Abstract (English)
In a context of malware analysis, numerous approaches rely on Artificial Intelligence to handle a large volume of data. However, these techniques focus on data view (images, sequences) and not on an expert's view. Noticing this issue, we propose a preprocessing that focuses on expert knowledge to improve malware semantic analysis and result interpretability. We propose a new preprocessing method which creates JSON reports for Portable Executable files. These reports gather features from both static and behavioral analysis, and incorporate packer signature detection, MITRE ATT\&CK and Malware Behavior Catalog (MBC) knowledge. The purpose of this preprocessing is to gather a semantic representation of binary files, understandable by malware analysts, and that can enhance AI models' explainability for malicious files analysis. Using this preprocessing to train a Large Language Model for Malware classification, we achieve a weighted-average F1-score of 0.94 on a complex dataset, representative of market reality.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。