用多个反编译器视图提升大模型恶意软件分类准确率
Multi-View Decompilation for LLM-Based Malware Classification
- 同时使用Ghidra和RetDec双反编译视图，提供互补信息
- 多视图输入使恶意样本召回率显著提升，F1值提高
- 无需训练，适合实际安全分析场景
恶意软件分析常依赖反编译后的伪C代码。现有方法多基于单一反编译器视图，但反编译器是损失性启发式工具，不同工具可能揭示同一二进制文件的不同特征。本文构建了涵盖多种威胁行为的良性工具与恶意程序基准数据集，对每个样本使用Ghidra和RetDec分别编译并反编译，获得匹配的伪C视图。在多个主流大语言模型上测试发现，提供双反编译视图可显著提升恶意类别F1值，主要源于对恶意样本召回率的改善。一致性分析显示，Ghidra与RetDec存在部分差异性错误，验证了反编译输出具有互补性。结果表明，多反编译器提示是一种简单、无需训练的提升大模型恶意软件分类效果的方法。
原文摘要 · Abstract (English)
Malware analysts often inspect compiled binaries through decompiled pseudo-C, when source code is unavailable. Recent work suggests that large language models (LLMs) can assist this process by classifying decompiled code as benign or malicious, but existing pipelines typically rely on a single decompiler view. We argue that this assumption is fragile: decompilers are lossy heuristic tools, and different decompilers can expose different artefacts of the same binary. We curate a benchmark of benign utilities and malicious programs spanning a range of threat behaviors. Each sample is compiled and decompiled with both Ghidra and RetDec, yielding matched pseudo-C views. Across a range of LLMs from major model families, we find that providing both decompiler views improves malicious-class F1, mainly by increasing recall on malicious samples. Agreement analyses further show that Ghidra and RetDec make partially different errors, supporting the view that decompiler outputs provide complementary evidence. Our results suggest that multi-decompiler prompting is a simple, training-free way to improve LLM-based malware triage in practical settings.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。