Large Language Model-Enhanced Malware Dynamic Detection Method

With the rapid advancement of network technology, incidents of network attacks are increasingly frequent, and malware has become a commonly used tool in such attacks. Dynamic analysis plays a crucial role for security professionals in understanding and assessing malware, allowing for the capture of dynamic behaviors within a sandbox environment. However, determining the maliciousness of these behaviors often requires substantial expert knowledge, making the process both time-consuming and challenging. To address this, we propose an automated technique for determining sandbox analysis reports as malicious or benign. Our approach combines dynamic features extracted from sandbox reports with a large language model. By fine-tuning a model based on Llama3, we achieve accurate determination between malicious and benign samples, reaching a precision of 96.82%, a recall of 93.84%, and an F1 score of 95.31%. The average recall rate for known malware family variants reached 99.16%, while for unknown families, it was 98.83%. These encouraging experimental results validate the feasibility of applying large language models in malware maliciousness determination, which has significant implications for the field of cybersecurity.