LoRA微调可在节省80%训练时间的同时,保持与全量微调相当的恶意软件解释能力。
Accuracy and Efficiency Trade-Offs in LLM-Based Malware Detection and Explanation: A Comparative Study of Parameter Tuning vs. Full Fine-Tuning
- 用低秩适配(LoRA)替代全量微调,降低模型参数量。
- 中等规模LoRA模型在两项指标上优于全量微调,且训练时间减少80%以上。
- 适合资源受限环境中的可解释恶意软件检测系统部署。
本研究探讨了低秩适配(LoRA)微调的大语言模型(LLMs)能否在生成人类可理解的恶意软件分类决策与解释方面逼近全量微调模型的表现。为评估解释质量,我们采用BLEU、ROUGE和语义相似性度量构建评估框架,对比五种LoRA配置与一个全量微调基线。结果表明,全量微调获得最高综合得分,其BLEU和ROUGE较LoRA变体最高提升10%。然而,中等规模的LoRA模型在两项指标上表现优于全量微调,同时将模型大小减少约81%,训练时间缩短超80%(针对含15.5%可训练参数的LoRA模型)。这些发现表明,LoRA在可解释性与资源效率间提供了实用平衡,使系统可在资源受限环境下部署而不牺牲解释质量。通过提供基于特征的自然语言解释,该方法增强了恶意软件检测系统的透明度、分析师信心与可扩展性。
原文摘要 · Abstract (English)
This study examines whether Low-Rank Adaptation (LoRA) fine-tuned Large Language Models (LLMs) can approximate the performance of fully fine-tuned models in generating human-interpretable decisions and explanations for malware classification. Achieving trustworthy malware detection, particularly when LLMs are involved, remains a significant challenge. We developed an evaluation framework using Bilingual Evaluation Understudy (BLEU), Recall-Oriented Understudy for Gisting Evaluation (ROUGE), and Semantic Similarity Metrics to benchmark explanation quality across five LoRA configurations and a fully fine-tuned baseline. Results indicate that full fine-tuning achieves the highest overall scores, with BLEU and ROUGE improvements of up to 10% over LoRA variants. However, mid-range LoRA models deliver competitive performance exceeding full fine-tuning on two metrics while reducing model size by approximately 81% and training time by over 80% on a LoRA model with 15.5% trainable parameters. These findings demonstrate that LoRA offers a practical balance of interpretability and resource efficiency, enabling deployment in resource-constrained environments without sacrificing explanation quality. By providing feature-driven natural language explanations for malware classifications, this approach enhances transparency, analyst confidence, and operational scalability in malware detection systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。