用字符串特征结合大模型，提升恶意软件家族识别准确率。
Rethinking and Exploring String-Based Malware Family Classification in the Era of LLMs and RAG
- 将特定字符串作为检索知识，类比RAG增强分类。
- 在67个家族4347个样本上测试，最高提升120%。
- 适合做恶意软件分析或安全研究的从业者参考。
恶意软件家族分类旨在识别样本所属的具体家族（如GuLoader或BitRAT），不同于仅判断是否恶意的检测或样本分类。准确识别家族可显著促进VirusTotal、MalwareBazaar等众包平台的自动化标签生成与理解，这些平台每天产生海量数据。本文探索在大语言模型（LLMs）和检索增强生成（RAG）时代下，传统二进制字符串特征用于家族分类的可行性。具体而言，我们研究如何将家族特异性字符串（FSS）以类似RAG的方式用于分类。为此，我们构建了覆盖67个恶意软件家族、共4,347个样本的评估框架，提取并分析超过2500万条字符串，并对四个核心模块进行详尽消融实验，各模块带来的相对性能提升介于8.1%至120%之间。
原文摘要 · Abstract (English)
Malware family classification aims to identify the specific family (e.g., GuLoader or BitRAT) a malware sample may belong to, in contrast to malware detection or sample classification, which only predicts a Yes/No outcome. Accurate family identification can greatly facilitate automated sample labeling and understanding on crowdsourced malware analysis platforms such as VirusTotal and MalwareBazaar, which generate vast amounts of data daily. In this paper, we explore and assess the feasibility of using traditional binary string features for family classification in the new era of large language models (LLMs) and Retrieval-Augmented Generation (RAG). Specifically, we investigate howFamily-Specific String (FSS) features can be utilized in a manner similar to RAG to facilitate family classification. To this end, we develop a curated evaluation framework covering 4,347 samples from 67 malware families, extract and analyze over 25 million strings, and conduct detailed ablation studies to assess the impact of different design choices in four major modules, with each providing a relative improvement ranging from 8.1% to 120%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。