When LLM Decompilers Recompile More and Preserve Less
研究解决了LLM反编译器在重新编译时行为不一致的问题,提出了一种名为Decompile-Diverge的行为比较方法来检测这种差异。
研究解决了LLM反编译器在重新编译时行为不一致的问题,提出了一种名为Decompile-Diverge的行为比较方法来检测这种差异。
论文指出SHAP在解释恶意软件检测模型时不可靠,通过分析其对特征联盟游戏而非数据中恶意行为的解释,提出需明确数据分布和领域验证。
This work addresses alert fatigue and detection backlogs in Security Operations Centers by proposing an automated triage method that integrates chain-of-thought reasoning into large language models. It pioneers the application of chain-of-thought prompting to Windows endpoint threat detection, enhanced through automatic prompt optimization, self-training, and reinforcement learning fine-tuned with verifiable rewards. To mitigate confidence degradation during reasoning, an independent probability calibrator is introduced. Experimental results demonstrate that the proposed approach, under task-specific fine-tuning, substantially outperforms general-purpose large language models, achieving an overall accuracy of 82.6%. In high-confidence automated triage scenarios, it improves recall rates by 43.0% for benign samples and 18.3% for malicious ones.
This study addresses the challenge of early detection of stealthy reconnaissance activities in Active Directory conducted via the LDAP protocol, which are often difficult to identify due to their benign appearance. To tackle this issue, the authors propose an automated, annotation-free detection approach that innovatively integrates weakly supervised learning with statistical hypothesis testing. The weakly supervised component trains a classifier to assess the maliciousness of LDAP queries, achieving a 65% true positive rate on a hold-out set while maintaining low false positives. Complementarily, statistical hypothesis testing correlates endpoint telemetry to extract high-confidence signatures of malicious queries, yielding a practical precision of 81.48%. This work represents the first effort to combine these techniques for LDAP-based reconnaissance detection, enabling scalable, automatic discovery and signature extraction of malicious behaviors.
Traditional large language models struggle to directly process raw bytes of executable files, limiting their applicability to binary understanding tasks such as malware analysis. This work proposes the first large language model natively designed for byte-level input, integrating a custom byte tokenizer, byte-level language modeling, and injection of binary-domain knowledge to enable semantic understanding and question answering over compiled code. Experimental results demonstrate that the proposed approach achieves 69% accuracy in malware family classification and 98% accuracy in architecture classification, substantially outperforming general-purpose large language models. These findings underscore the effectiveness and necessity of native byte-level modeling combined with domain-specific knowledge for advancing binary analysis capabilities.
研究解决了LLM反编译器在重新编译时行为不一致的问题,提出了一种名为Decompile-Diverge的行为比较方法来检测这种差异。
论文指出SHAP在解释恶意软件检测模型时不可靠,通过分析其对特征联盟游戏而非数据中恶意行为的解释,提出需明确数据分布和领域验证。
This work addresses alert fatigue and detection backlogs in Security Operations Centers by proposing an automated triage method that integrates chain-of-thought reasoning into large language models. It pioneers the application of chain-of-thought prompting to Windows endpoint threat detection, enhanced through automatic prompt optimization, self-training, and reinforcement learning fine-tuned with verifiable rewards. To mitigate confidence degradation during reasoning, an independent probability calibrator is introduced. Experimental results demonstrate that the proposed approach, under task-specific fine-tuning, substantially outperforms general-purpose large language models, achieving an overall accuracy of 82.6%. In high-confidence automated triage scenarios, it improves recall rates by 43.0% for benign samples and 18.3% for malicious ones.
This study addresses the challenge of early detection of stealthy reconnaissance activities in Active Directory conducted via the LDAP protocol, which are often difficult to identify due to their benign appearance. To tackle this issue, the authors propose an automated, annotation-free detection approach that innovatively integrates weakly supervised learning with statistical hypothesis testing. The weakly supervised component trains a classifier to assess the maliciousness of LDAP queries, achieving a 65% true positive rate on a hold-out set while maintaining low false positives. Complementarily, statistical hypothesis testing correlates endpoint telemetry to extract high-confidence signatures of malicious queries, yielding a practical precision of 81.48%. This work represents the first effort to combine these techniques for LDAP-based reconnaissance detection, enabling scalable, automatic discovery and signature extraction of malicious behaviors.
Traditional large language models struggle to directly process raw bytes of executable files, limiting their applicability to binary understanding tasks such as malware analysis. This work proposes the first large language model natively designed for byte-level input, integrating a custom byte tokenizer, byte-level language modeling, and injection of binary-domain knowledge to enable semantic understanding and question answering over compiled code. Experimental results demonstrate that the proposed approach achieves 69% accuracy in malware family classification and 98% accuracy in architecture classification, substantially outperforming general-purpose large language models. These findings underscore the effectiveness and necessity of native byte-level modeling combined with domain-specific knowledge for advancing binary analysis capabilities.