构建框架与数据集，评估生成式AI编写的恶意PowerShell代码。
AI-Generated PowerShell Malware: An Experimental Framework and Dataset
- 设计新型沙箱动态分析生成的恶意PowerShell代码。
- 生成代码与真实恶意代码在触发系统事件上相似度达84.5%中位数。
- 提供人工标注的自然语言描述数据集，助模型训练与评测。
生成式AI已成为重大网络安全威胁，近期攻击活动已利用大语言模型（LLM）通过PowerShell等脚本语言生成恶意代码。为帮助安全分析师评估生成式AI的攻击能力，本文提出一个实验框架，用于评估LLM生成的PowerShell恶意软件。该框架包含一种新型沙箱方法，用于动态分析AI生成的恶意代码。同时，我们构建了一个全新的人工标注的真实世界PowerShell恶意软件数据集，并以自然语言进行注释，以支持LLM的训练与评估。最后，研究评估了若干宽松许可、开放权重的LLM在生成恶意PowerShell代码方面的表现。结果表明，生成代码与真实恶意代码在触发操作系统恶意事件方面具有高度相似性，中位数Jaccard指数达84.5%，其中48.4%的实例实现完全重叠。
原文摘要 · Abstract (English)
Generative AI has emerged as a significant cybersecurity threat, with several recent attack campaigns leveraging LLMs to generate code for malicious purposes via scripting languages such as PowerShell. Consequently, for cybersecurity analysts, it is imperative to investigate the offensive capabilities of AI code generators. In this paper, we propose an experimental framework to assess LLM-generated PowerShell malware, which comprises a novel sandbox approach for dynamic analysis of AI-generated malware. Furthermore, we present a novel, manually curated dataset of real-world PowerShell malware, annotated in natural language to assist the training and evaluation of LLMs. Finally, this study evaluates permissive, open-weight LLMs adapted to PowerShell malware generation. Our results reveal a high degree of similarity between real malware and LLM-generated ones in terms of triggered OS malicious events, with a median Jaccard index of 84.5% and 48.4% of instances achieving complete overlap.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。