用大模型分析反编译代码，提升恶意软件检测能力
A Decompilation-Driven Framework for Malware Detection with Large Language Models
- 先反编译可执行文件为C代码，再用大模型分类
- 微调后模型准确率显著高于原始模型
- 需持续更新数据以应对新型恶意代码
大型语言模型（LLM）在代码理解方面的能力与日益复杂的恶意软件并行发展，为网络安全研究开辟了新方向。本文评估了前沿大模型对可执行代码进行良性或恶意分类的有效性。我们提出一个自动化流程：首先使用Ghidra反汇编器将Windows可执行文件反编译为C代码，然后利用大模型完成分类任务。实验表明，尽管标准大模型具有潜力，但尚不足以替代传统杀毒软件。经过精心筛选的恶意软件与良性样本微调后的模型，显著优于原始模型。然而，即使该专用模型在面对新型恶意软件时性能也明显下降。这表明，必须持续用新兴威胁数据进行微调，才能保持模型对恶意软件编码模式和行为变化的有效应对能力。
原文摘要 · Abstract (English)
The parallel evolution of Large Language Models (LLMs) with advanced code-understanding capabilities and the increasing sophistication of malware presents a new frontier for cybersecurity research. This paper evaluates the efficacy of state-of-the-art LLMs in classifying executable code as either benign or malicious. We introduce an automated pipeline that first decompiles Windows executable into a C code using Ghidra disassembler and then leverages LLMs to perform the classification. Our evaluation reveals that while standard LLMs show promise, they are not yet robust enough to replace traditional anti-virus software. We demonstrate that a fine-tuned model, trained on curated malware and benign datasets, significantly outperforms its vanilla counterpart. However, the performance of even this specialized model degrades notably when encountering newer malware. This finding demonstrates the critical need for continuous fine-tuning with emerging threats to maintain model effectiveness against the changing coding patterns and behaviors of malicious software.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。