用大模型生成安卓恶意软件数据，能有效补充真实样本不足问题。
LLM-Generated Samples for Android Malware Detection
- 用GPT-4.1-mini生成三种恶意家族的结构化样本。
- 合成数据+真实数据训练，检测率接近纯真实数据训练。
- 仅用合成数据训练效果不稳定，依赖具体家族和微调策略。
安卓恶意软件通过混淆和多态性持续演化，对基于签名的防御及在有限且不平衡数据集上训练的机器学习模型构成挑战。合成数据被视为缓解数据稀缺的手段，但大语言模型（LLMs）在生成有效恶意软件数据用于检测任务中的作用仍待探索。本研究使用KronoDroid数据集，对GPT-4.1-mini进行微调，生成BankBot、Locker/SLocker和Airpush/StopSMS三个恶意软件家族的结构化记录。通过提示工程与后处理解决生成不一致问题后，在三种设置下评估多个分类器：仅用真实数据训练、真实数据加合成数据训练、仅用合成数据训练。结果表明，仅用真实数据训练可实现近乎完美的检测率；加入合成数据后性能保持高位，仅有轻微下降；而仅用合成数据训练则结果参差不齐，不同恶意软件家族和微调策略间表现差异显著。这表明LLM生成的恶意软件数据可有效增强稀缺数据集且不降低检测精度，但尚不足以作为独立训练来源。
原文摘要 · Abstract (English)
Android malware continues to evolve through obfuscation and polymorphism, posing challenges for both signature-based defenses and machine learning models trained on limited and imbalanced datasets. Synthetic data has been proposed as a remedy for scarcity, yet the role of large language models (LLMs) in generating effective malware data for detection tasks remains underexplored. In this study, we fine-tune GPT-4.1-mini to produce structured records for three malware families: BankBot, Locker/SLocker, and Airpush/StopSMS, using the KronoDroid dataset. After addressing generation inconsistencies with prompt engineering and post-processing, we evaluate multiple classifiers under three settings: training with real data only, real-plus-synthetic data, and synthetic data alone. Results show that real-only training achieves near perfect detection, while augmentation with synthetic data preserves high performance with only minor degradations. In contrast, synthetic-only training produces mixed outcomes, with effectiveness varying across malware families and fine-tuning strategies. These findings suggest that LLM-generated malware can enhance scarce datasets without compromising detection accuracy, but remains insufficient as a standalone training source.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。