用少量标注样本生成高质量恶意代码并提升检测能力
Learning from Few Samples: A Novel Approach for High-Quality Malcode Generation
- GAN与LLM协同训练，用生成样本增强真实样本
- 仅需少量标注数据，恶意代码生成与检测效果显著提升
- 适合需要快速应对新型网络攻击的防御系统开发者
入侵检测系统（IDS）在网络安全防御中至关重要，但其模型训练常面临恶意样本标注不足的问题。为此，本文提出一种新颖的半监督框架GANGRL-LLM，融合生成对抗网络（GAN）与大语言模型（LLM），在少样本学习场景下提升恶意代码生成与SQL注入（SQLi）检测能力。该框架采用协同训练机制：(1) 基于GAN的判别器通过生成样本与有限真实样本的对抗学习，强化恶意模式识别；(2) 基于LLM的生成器利用判别器提供的奖励信号，优化恶意代码合成质量。实验表明，即使在标注样本极少的情况下，该框架仍能有效提升恶意代码生成与检测性能，为应对不断演化的网络威胁提供了可适应的防御方案。
原文摘要 · Abstract (English)
Intrusion Detection Systems (IDS) play a crucial role in network security defense. However, a significant challenge for IDS in training detection models is the shortage of adequately labeled malicious samples. To address these issues, this paper introduces a novel semi-supervised framework \textbf{GANGRL-LLM}, which integrates Generative Adversarial Networks (GANs) with Large Language Models (LLMs) to enhance malicious code generation and SQL Injection (SQLi) detection capabilities in few-sample learning scenarios. Specifically, our framework adopts a collaborative training paradigm where: (1) the GAN-based discriminator improves malicious pattern recognition through adversarial learning with generated samples and limited real samples; and (2) the LLM-based generator refines the quality of malicious code synthesis using reward signals from the discriminator. The experimental results demonstrate that even with a limited number of labeled samples, our training framework is highly effective in enhancing both malicious code generation and detection capabilities. This dual enhancement capability offers a promising solution for developing adaptive defense systems capable of countering evolving cyber threats.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。