用大模型零样本选特征，让恶意软件检测更准更透明
LLM-FS: Zero-Shot Feature Selection for Effective and Interpretable Malware Detection
- 仅凭特征名和任务描述，让大模型自动筛选关键特征
- 在EMBOD数据集上达到与传统方法相当的检测精度
- 结果更易解释，且无需大量标注数据，适合安全领域
特征选择对构建高准确率且可解释的恶意软件检测模型至关重要，尤其在高维数据下。传统方法如随机森林、方差阈值、卡方检验等依赖统计启发式或模型重要性得分，常忽略特征的语义上下文。受大语言模型（LLM）在特征选择中应用的启发，本文研究大模型能否在零样本条件下，仅通过特征名称和任务描述，指导特征选择，作为传统方法的替代方案。我们在EMBOD数据集（由EMBER和BODMAS融合而成）上评估了GPT-5.0、GPT-4.0、Gemini-2.5等多个大模型，对比其与多种经典特征选择方法在随机森林、额外树、MLP和KNN等分类器上的表现。评估指标包括准确率、精确率、召回率、F1、AUC、MCC和运行时间。结果显示，基于大模型的零样本特征选择在性能上可媲美传统方法，同时在可解释性、稳定性及降低对标注数据依赖方面具有优势。这表明零样本大模型驱动的特征选择是实现高效、可解释恶意软件检测的有前景策略，为安全关键场景中的知识引导特征选择提供新方向。
原文摘要 · Abstract (English)
Feature selection (FS) remains essential for building accurate and interpretable detection models, particularly in high-dimensional malware datasets. Conventional FS methods such as Extra Trees, Variance Threshold, Tree-based models, Chi-Squared tests, ANOVA, Random Selection, and Sequential Attention rely primarily on statistical heuristics or model-driven importance scores, often overlooking the semantic context of features. Motivated by recent progress in LLM-driven FS, we investigate whether large language models (LLMs) can guide feature selection in a zero-shot setting, using only feature names and task descriptions, as a viable alternative to traditional approaches. We evaluate multiple LLMs (GPT-5.0, GPT-4.0, Gemini-2.5 etc.) on the EMBOD dataset (a fusion of EMBER and BODMAS benchmark datasets), comparing them against established FS methods across several classifiers, including Random Forest, Extra Trees, MLP, and KNN. Performance is assessed using accuracy, precision, recall, F1, AUC, MCC, and runtime. Our results demonstrate that LLM-guided zero-shot feature selection achieves competitive performance with traditional FS methods while offering additional advantages in interpretability, stability, and reduced dependence on labeled data. These findings position zero-shot LLM-based FS as a promising alternative strategy for effective and interpretable malware detection, paving the way for knowledge-guided feature selection in security-critical applications
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。