XGen-Q用大模型+检索增强实现可解释的恶意代码检测
XGen-Q: An Explainable Domain-Adaptive LLM Framework with Retrieval-Augmented Generation for Software Security
- 基于Qwen-Coder架构，融合检索增强生成技术
- 在百万级恶意样本上训练，对新变种检测准确率高
- 适合安全研究者和自动化分析系统使用
生成式AI与大语言模型在代码理解方面表现强劲，但在网络安全领域，尤其是恶意软件检测与分析中的应用仍有限。现有系统难以泛化到经过混淆或未见过的威胁，凸显出对更适应性强且可解释模型的需求。为此，我们提出XGen-Q，一个基于Qwen-Coder架构、在超过一百万份恶意样本（涵盖源码与汇编码）上预训练的领域自适应大模型。XGen-Q采用多阶段提示策略结合检索增强生成（RAG），在复杂代码混淆环境下仍能实现可靠的恶意软件识别与详尽的取证报告。为提升泛化能力，我们设计了系统化的训练流程，使模型广泛接触各类混淆模式。实验表明，相比基线模型，XGen-Q显著降低困惑度，并在新型恶意软件样本上表现优异，验证了基于大模型方法在可解释、鲁棒的恶意软件分析中的潜力。
原文摘要 · Abstract (English)
Generative AI and large language models (LLMs) have shown strong capabilities in code understanding, but their use in cybersecurity, particularly for malware detection and analysis, remains limited. Existing detection systems often fail to generalize to obfuscated or previously unseen threats, underscoring the need for more adaptable and explainable models. To address this challenge, we introduce XGen-Q, a domain-adapted LLM built on the Qwen-Coder architecture and pretrained on a large-scale corpus of over one million malware samples, spanning both source and assembly code. XGen-Q uses a multi-stage prompt strategy combined with retrieval-augmented generation (RAG) to deliver reliable malware identification and detailed forensic reporting, even in the presence of complex code obfuscation. To further enhance generalization, we design a training pipeline that systematically exposes the model to diverse obfuscation patterns. Experimental results show that XGen-Q achieves significantly lower perplexity than competitive baselines and exhibits strong performance on novel malware samples, demonstrating the promise of LLM-based approaches for interpretable and robust malware analysis.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。