用大模型集成实现无需标签的恶意软件家族自动分类
Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models
- 通过加权分层集成多个大模型的预测结果，避免特征工程和训练
- 在真实数据上达到87.3%的宏观F1分数，优于传统方法
- 适合安全研究人员快速分析新型恶意软件，无需标注数据
恶意软件家族分类在自动化分析中仍具挑战性，尤其在存在混淆、打包及快速演化的威胁场景下。现有机器学习与深度学习方法通常依赖标注数据、手工特征、监督训练或动态分析，限制了其在开放世界中的可扩展性和有效性。本文提出一种基于预训练大语言模型（LLM）加权分层集成的零标签分类框架。该方法不依赖特征学习或模型重训练，而是聚合多个具备互补推理能力的LLM在决策层的输出。通过实证获取的宏观F1分数对模型输出加权，并采用分层结构，先识别粗粒度恶意行为，再细化到具体家族。该设计增强了鲁棒性，降低单个模型的不稳定性，且符合分析师的推理习惯。
原文摘要 · Abstract (English)
Malware family classification remains a challenging task in automated malware analysis, particularly in real-world settings characterized by obfuscation, packing, and rapidly evolving threats. Existing machine learning and deep learning approaches typically depend on labeled datasets, handcrafted features, supervised training, or dynamic analysis, which limits their scalability and effectiveness in open-world scenarios. This paper presents a zero-label malware family classification framework based on a weighted hierarchical ensemble of pretrained large language models (LLMs). Rather than relying on feature-level learning or model retraining, the proposed approach aggregates decision-level predictions from multiple LLMs with complementary reasoning strengths. Model outputs are weighted using empirically derived macro-F1 scores and organized hierarchically, first resolving coarse-grained malicious behavior before assigning fine-grained malware families. This structure enhances robustness, reduces individual model instability, and aligns with analyst-style reasoning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。