用大模型生成行为特征，提升恶意软件分类准确率
BEACON: Behavioral Malware Classification with Large Language Model Embeddings and Deep Learning
- 用大模型将沙箱行为报告转为语义嵌入向量
- 在Avast-CTU数据集上超越现有方法表现
- 适合安全研究者和恶意软件检测开发者
恶意软件日益复杂且泛滥，亟需更高效及时的检测手段。传统静态分析难以应对代码混淆、多态性等现代逃逸技术。相比之下，基于运行时行为监测的检测方法更具可靠性与上下文感知能力。本文提出BEACON，一种新型深度学习框架，利用大语言模型（LLMs）从原始沙箱生成的行为报告中提取密集的上下文嵌入。这些嵌入捕捉样本的语义与结构模式，并通过一维卷积神经网络（1D CNN）进行多类别恶意软件分类。在Avast-CTU公共CAPE数据集上的评估显示，该框架持续优于现有方法，验证了基于LLM的行为嵌入及整体设计在鲁棒恶意软件分类中的有效性。
原文摘要 · Abstract (English)
Malware is becoming increasingly complex and widespread, making it essential to develop more effective and timely detection methods. Traditional static analysis often fails to defend against modern threats that employ code obfuscation, polymorphism, and other evasion techniques. In contrast, behavioral malware detection, which monitors runtime activities, provides a more reliable and context-aware solution. In this work, we propose BEACON, a novel deep learning framework that leverages large language models (LLMs) to generate dense, contextual embeddings from raw sandbox-generated behavior reports. These embeddings capture semantic and structural patterns of each sample and are processed by a one-dimensional convolutional neural network (1D CNN) for multi-class malware classification. Evaluated on the Avast-CTU Public CAPE Dataset, our framework consistently outperforms existing methods, highlighting the effectiveness of LLM-based behavioral embeddings and the overall design of BEACON for robust malware classification.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。