用代码级大模型提升恶意软件溯源准确率，支持真实场景分析。
LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution
- 构建代码为中心的34K样本数据集，融合反汇编与控制流图等多源特征
- 通过检索增强生成与验证机制，实现90%以上任务的结构化报告生成
- 适合安全分析师用于自动化恶意软件分析与威胁情报提取
大型语言模型在恶意软件分析中日益受到关注，但现有基于LLM的恶意软件溯源仍受限于指标不支持及代码层面的不足。为此，本文提出LCC-LLM，一个以代码为中心的基准数据集与证据驱动的恶意软件溯源框架。所构建的LCCD数据集包含约34,000个经过大规模逆向工程处理的PE样本，以反编译C代码、汇编代码、控制流图（CFG/FCG）、十六进制数据、PE元数据、可疑API证据及结构特征表示。框架结合LangGraph协调的静态分析与多源网络安全知识，采用七层检索增强生成管道，使用CoVe进行指标验证，并引入多维质量门控提升事实可靠性与分析师支持能力。通过课程式指令数据微调DeepSeek-R1-Distill-Qwen-14B和Qwen3-Coder-30B-A3B模型（使用QLoRA）。在43种恶意软件分析任务上平均语义相似度达0.634，最高性能体现在结构化报告生成、指标提取、漏洞评估、配置提取和分类检测。在真实案例研究中，基于MalwareBazaar样本的接地流程达到10/10的结构化分析通过率，生成了CFG/FCG证据、MITRE ATT&CK映射、检测建议与分析师可用报告。结果表明，代码中心表征、检索对齐与验证引导推理显著提升了大模型辅助溯源的可靠性和实用性。
原文摘要 · Abstract (English)
LLMs are increasingly explored for malware analysis; however, current LLM-based malware attribution remains limited by unsupported indicators and insufficient code-level grounding for identifying malicious and vulnerable code segments. To address these limitations, this research introduces LCC-LLM, a code-centric benchmark dataset and evidence-grounded framework for malware attribution and multi-task static malware analysis. The proposed LCCD dataset contains approximately 34K PE samples processed through a large-scale reverse-engineering pipeline and represented using decompiled C code, assembly code, CFG/FCG artifacts, hexadecimal data, PE metadata, suspicious API evidence, and structural features. Beyond dataset construction, LCC-LLM integrates LangGraph-orchestrated static analysis with multi-source cybersecurity knowledge to support evidence-grounded malware reasoning. The framework employs a seven-layer retrieval-augmented generation pipeline, CoVe for IoC validation, and a multi-dimensional quality gate to improve factual reliability and analyst-oriented decision support. Curriculum-ordered instruction data is used to fine-tune DeepSeek-R1-Distill-Qwen-14B and Qwen3-Coder-30B-A3B using QLoRA. Evaluation across 43 malware-analysis task types achieves an average semantic similarity of 0.634, with the highest task-level performance in structured report generation, IoC extraction, vulnerability assessment, malware configuration extraction, and malware class detection. In a real-world case study using MalwareBazaar samples, the grounded pipeline achieves a 10/10 structured analysis pass rate, producing CFG/FCG evidence, MITRE ATT&CK mappings, detection guidance, and analyst-ready reports. These results show that code-centric representations, retrieval grounding, and verification-guided reasoning improve the reliability and operational usefulness of LLM-assisted malware attribution.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。