A method, system, and storage medium for generating adversarial malware samples based on AST and LLM.

Abstract

This invention discloses a method, system, and storage medium for generating adversarial samples of malware based on Abstract Syntax Tree (AST) and Language Runtime Model (LLM). The method includes the following steps: parsing malware samples to obtain their abstract syntax tree (AST); constructing a semantically preserved set of perturbation rules based on the AST structure; building an adversarial attack model based on deep learning; optimizing the generator using a deep reinforcement learning algorithm to determine the optimal AST perturbation action; converting the selected AST perturbation action into structured prompt words and generating code variants using LLM; and compiling, verifying, and repairing the LLM-generated code to generate executable adversarial samples that retain malicious functionality. This invention addresses the problems of insufficient robustness in existing malware adversarial sample generation methods and the lack of structural constraints when directly applying large language models to generate malicious code.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a method, system and storage medium for generating adversarial samples of malware based on AST and LLM. Background Technology

[0002] With the rapid development of mobile internet and smart terminals, the number of malware programs continues to grow. Existing malware detection technologies widely employ automated analysis methods based on machine learning or deep learning to classify software using static or dynamic features. However, research shows that these detection models generally suffer from insufficient robustness against adversarial examples.

[0003] Existing adversarial malware generation methods typically rely on rule-based or templated code transformations, such as inserting fixed, dead code blocks, string encryption / decryption templates, or control flow wrapping structures. While these methods can evade detection to some extent, the generated code often exhibits obvious human artifacts, making it easily identifiable by deobfuscation tools or next-generation detection models. Furthermore, templated methods lack flexibility and generalization capabilities, making it difficult to adapt to different programming languages ​​and complex program structures.

[0004] In recent years, large language models have demonstrated strong capabilities in code generation and semantic preservation. However, their direct application to malicious code generation can easily lead to syntax errors or disrupt the original program logic, and they lack structural constraints. Therefore, how to guide large language models to generate natural, diverse, and evasive adversarial malware samples while ensuring semantic consistency remains a pressing technical problem to be solved.

[0005] To address the shortcomings of existing adversarial malware generation methods in terms of robustness and the lack of structural constraints when directly applying large language models to generate malicious code, this paper proposes a method, system, and storage medium for generating adversarial malware based on AST and LLM. Summary of the Invention

[0006] This invention proposes a method, system, and storage medium for generating adversarial samples of malware based on AST and LLM, in order to at least solve the problems of insufficient robustness of existing adversarial sample generation methods and the lack of structural constraints when large language models are directly applied to generate malicious code.

[0007] According to an embodiment of the present invention, a method for generating adversarial malware samples based on AST and LLM is provided, comprising:

[0008] Parse malware samples to obtain their Abstract Syntax Tree (AST).

[0009] A set of semantically preserved perturbation rules is constructed based on the AST structure;

[0010] Construct an adversarial attack model based on deep learning; the generator includes an operation rule selection model and an operation position selection model, and the discriminator serves as an alternative model to simulate a target detector;

[0011] The generator is optimized using deep reinforcement learning algorithms to determine the optimal AST perturbation action;

[0012] The selected AST perturbation actions are transformed into structured cue words and code variants are generated using LLM;

[0013] The code generated by LLM is compiled, verified, and repaired to generate an executable adversarial sample that retains malicious functionality.

[0014] In a preferred embodiment, parsing the malware sample to obtain its Abstract Syntax Tree (AST) includes:

[0015] Use decompilation tools to decompile malware samples into code files;

[0016] The code file is parsed using a parser to generate an Abstract Syntax Tree (AST).

[0017] In a preferred embodiment, the step of constructing a semantically preserved perturbation rule set based on the AST structure includes the following steps:

[0018] Identify key non-leaf nodes in the AST, including expression nodes, statement nodes, and method declaration nodes, as potential perturbation injection points;

[0019] Construct code-level AST operation rules, including modifying If statement conditions, adding meaningless AST nodes, adding input parameters, inserting dead code, method wrapping, method overriding, string encryption, and reflection call replacement;

[0020] Data manipulation rules for building metadata files, including insertion or renaming, as well as insertion request permissions and hardware component declarations;

[0021] A set of semantically preserving perturbation rules is constructed based on the AST operation rules at the code level and the data operation rules of the metadata file.

[0022] In a preferred embodiment, constructing a deep learning-based adversarial attack model includes the following steps:

[0023] A deep Q-network is used to construct the operation rule selection model in the generator;

[0024] A proximal strategy optimization algorithm is used to construct the operation position selection model in the generator;

[0025] Construct a local deep neural network, i.e., a replacement model D, to simulate the target detector in a black-box scenario;

[0026] The alternative model is trained by querying the object detector to obtain feedback labels and using the binary cross-entropy loss function, so that its output approximates the decision boundary of the object detector.

[0027] In a preferred embodiment, the step of optimizing the generator using a deep reinforcement learning algorithm to determine the optimal AST perturbation action includes the following steps:

[0028] In each iteration, the operation position selection model is used to select k target methods through a Top-k sampling strategy;

[0029] The model is selected using operational rules to choose specific perturbation actions for the selected target method and applied to the samples to obtain perturbed samples.

[0030] The perturbated sample is input into the alternative model D for evaluation, and the real target detector is queried only when the alternative model is successfully evaded.

[0031] Construct a segmented reward function;

[0032] Update the generator parameters based on status information and / or action information and / or reward information.

[0033] In a preferred embodiment, updating the generator parameters based on state information and / or action information and / or reward information includes the following steps:

[0034] The network parameters of the model are selected using the rule of minimizing the mean square Bellman error update operation.

[0035] The advantage function is calculated using the generalized advantage estimation algorithm;

[0036] The network parameters of the operation location selection model are updated based on the advantage function and the objective function of maximizing PPO-Clip.

[0037] In a preferred embodiment, the step of converting the selected AST perturbation action into structured cue words and generating code variants via LLM includes the following steps:

[0038] Specify the role of the large language model as an expert programmer in the prompt words;

[0039] Specific AST modification requirements and constraints are set based on the optimal AST perturbation action;

[0040] Provide valid AST transformations and their corresponding code examples in the prompts to guide the output style of LLM;

[0041] Combine the above parts into a complete structured prompt and input the source code snippet to be modified into LLM to generate a code variant.

[0042] In a preferred embodiment, the step of compiling, verifying, and repairing the code generated by the LLM to generate an executable adversarial sample that retains malicious functionality includes:

[0043] The code snippets generated by LLM are compiled using a standard compiler;

[0044] If compilation is successful, dynamic analysis is used to verify whether the malicious functions are retained. If they are retained, the output is an adversarial sample.

[0045] If compilation fails, extract the compiler's error log information;

[0046] The error log and the problematic code are fed back to the LLM as new prompt words, requesting it to analyze the error and generate the fixed code.

[0047] Repeat the above steps until compilation is successful or the preset maximum number of retries is reached.

[0048] According to another embodiment of the present invention, a computer-readable storage medium is provided that stores a computer program for electronic data interchange, wherein the computer program causes a computer to perform the above-described method.

[0049] According to another embodiment of the present invention, a malware adversarial sample generation system based on AST and LLM is provided, comprising:

[0050] processor;

[0051] Memory;

[0052] and one or more programs, wherein the one or more programs are stored in memory and configured to be executed by the signal processing unit, the programs causing the computer to perform the methods described above.

[0053] The advantages of the malware adversarial sample generation method, system, and storage medium based on AST and LLM of the present invention are as follows:

[0054] (1) This invention constructs a multi-dimensional, semantically preserved set of perturbation rules that includes code and metadata levels, and injects perturbations based on the AST structure. Compared with traditional schemes that rely on fixed code templates or simple rule transformations, it can effectively achieve deeper and more covert program structure modifications, thereby greatly improving the complexity and diversity of the generated adversarial samples and significantly enhancing their ability to evade existing detection models.

[0055] (2) The present invention constructs a generator consisting of an operation rule selection model and an operation position selection model, and uses deep reinforcement learning for joint optimization. Compared with the traditional scheme of using heuristic or random strategies to select perturbation positions and methods, it can effectively realize intelligent and adaptive decision-making for attack action sequences, thereby finding effective perturbation combinations that can successfully bypass the detector more efficiently in complex code space, and improving the targeting and success rate of the attack.

[0056] (3) The present invention trains a local deep neural network as an alternative model to simulate a black box target detector. Compared with the traditional scheme that requires a large number of frequent queries to the real detector to obtain feedback, it can effectively reduce the number of direct queries to the target detector during the attack optimization process, thereby significantly reducing the attack cost and perceived risk, making the method more suitable for simulating attacks and robustness evaluation of real and unknown detection systems.

[0057] (4) This invention transforms the optimal AST perturbation action into structured prompts containing role settings, modification requirements, constraints and code examples, guiding the LLM to generate code variants. Compared with the traditional approach of directly requiring the LLM to generate malicious code or make unconstrained code modifications, this invention can effectively and accurately convey the high-level structural modification intent to the LLM, thereby making full use of the LLM's code generation and understanding capabilities, while ensuring that the generated code does not destroy the core function of the original malware and reducing meaningless output.

[0058] (5) The present invention introduces an automated iterative loop of “compilation verification-error analysis-LLM feedback repair”. Compared with the traditional scheme of simply verifying or manually repairing after code generation, it can effectively and automatically handle compilation errors and semantic deviations that may be generated by LLM, thereby ensuring that the final generated adversarial sample is not only an effective code variant, but also compileable, executable and retains the original malicious function, thus improving the automation of the generation process and the usability of the output.

[0059] (6) This invention deeply integrates formal AST analysis, data-driven reinforcement learning decision-making, and powerful LLM natural language generation capabilities. Compared with traditional solutions that rely on a single technical route, it can effectively leverage the advantages of each technology and make up for its shortcomings, forming a complete and collaborative adversarial sample generation solution. It systematically solves multiple challenges in the generation of adversarial samples for malware, such as concealment, effectiveness, controllability, and automation, and provides a more powerful tool for security assessment. Attached Figure Description

[0060] Figure 1 This is a flowchart of a method for generating adversarial malware samples based on AST and LLM according to an embodiment of the present invention.

[0061] Figure 2 This is a flowchart of step S01 of the malware adversarial sample generation method based on AST and LLM in an embodiment of the present invention.

[0062] Figure 3 This is a flowchart of step S02 of the malware adversarial sample generation method based on AST and LLM in an embodiment of the present invention.

[0063] Figure 4 This is a flowchart of step S03 of the malware adversarial sample generation method based on AST and LLM in an embodiment of the present invention.

[0064] Figure 5 This is a flowchart of sub-step S04 of the malware adversarial sample generation method based on AST and LLM in an embodiment of the present invention.

[0065] Figure 6 This is a flowchart of sub-step S045 of the malware adversarial sample generation method based on AST and LLM in an embodiment of the present invention.

[0066] Figure 7 This is a flowchart of sub-step S05 of the malware adversarial sample generation method based on AST and LLM in an embodiment of the present invention.

[0067] Figure 8 This is a flowchart of sub-step S06 of the malware adversarial sample generation method based on AST and LLM in an embodiment of the present invention.

[0068] Figure 9 This is a schematic diagram of the structure of the malware adversarial sample generation system based on AST and LLM according to an embodiment of the present invention. Detailed Implementation

[0069] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0070] According to an embodiment of the present invention, a method for generating adversarial samples of malware based on AST and LLM is provided, the flowchart of which is shown below. Figure 1 As shown, it includes:

[0071] Step S01: Parse the malware sample to obtain its Abstract Syntax Tree (AST);

[0072] Step S02: Construct a set of semantically preserved perturbation rules based on the AST structure;

[0073] Step S03: Construct an adversarial attack model based on deep learning;

[0074] Step S04: Optimize the generator using a deep reinforcement learning algorithm to determine the optimal AST perturbation action;

[0075] Step S05: Convert the selected AST perturbation action into structured cue words and generate code variants using LLM;

[0076] Step S06: Compile, verify, and repair the code generated by LLM to generate an executable adversarial sample that retains malicious functionality.

[0077] In a preferred embodiment, step S01, parsing the malware sample to obtain its Abstract Syntax Tree (AST), is illustrated in the flowchart below. Figure 2 As shown, it includes:

[0078] Step S011: Use a decompilation tool to decompile the malware sample into a code file;

[0079] Step S012: Use a syntax analyzer to parse the code file and generate an abstract syntax tree (AST).

[0080] In this embodiment, the decompilation tool Apktool is used to decompile the Android malware sample into a Smali code file; the Smali code is then parsed using a syntax analyzer to generate an Abstract Syntax Tree (AST).

[0081] In a preferred embodiment, step S02, constructing a semantically preserved perturbation rule set based on the AST structure, is illustrated in the flowchart below. Figure 3 As shown, the steps include:

[0082] Step S021: Identify key non-leaf nodes in the AST;

[0083] Step S022: Construct the AST operation rules at the code level;

[0084] Step S023: Construct data operation rules for metadata files;

[0085] Step S024: Construct a set of semantically preserved perturbation rules based on the AST operation rules at the code level and the data operation rules of the metadata file.

[0086] In this embodiment, the system identifies key non-leaf nodes in the AST, including expression nodes, statement nodes, and method declaration nodes, as potential perturbation injection points.

[0087] The code-level AST operation rules are constructed, including modifying If statement conditions, adding meaningless AST nodes, adding input parameters, inserting dead code, method wrapping, method overriding, string encryption, and reflection call replacement. The specific content is as follows:

[0088] (1) Modify the if statement condition (change simple conditions into logically equivalent complex expressions): Locate the condition judgment node in the AST and replace simple Boolean conditions (such as if (a == b)) with logically equivalent but structurally complex expressions (such as if (! (a != b)) or introduce a combination of always true / always false conditions);

[0089] (2) Add meaningless AST nodes: Insert nodes that have no effect on program logic in positions that do not affect the control flow;

[0090] (3) Add input parameters: Modify the method declaration node, add unused parameters, and update them synchronously at the call site;

[0091] (4) Insert dead code: Insert a code block that will never be executed (such as in an if (false) block);

[0092] (5) Method wrapping (encapsulating method calls into a new method): Create a new method node, encapsulate the original method call in it, and replace the original call point with a call to the new method;

[0093] (6) Overriding methods: Overriding parent class methods in a subclass to change the inheritance tree characteristics;

[0094] (7) String encryption: Replace the string literals in the AST with calls to the decryption function;

[0095] (8) Reflection call replacement: Replace the direct method call node with a reflection mechanism call.

[0096] For metadata files that cannot be parsed into an AST (such as AndroidManifest.xml), define metadata operation rules, including inserting or renaming Activities, Services, Broadcast Receivers, and inserting permission requests and hardware component declarations; for example, inserting or renaming files. <activity> , <service> , <receiver>Tags; in <uses-permission>Insert irrelevant permission requests into the list; <uses-feature>Insert hardware component declarations.

[0097] Based on the AST operation rules at the code level and the data operation rules of the metadata file, a set of semantically preserved perturbation rules is generated.

[0098] In a preferred embodiment, step S03, constructing a deep learning-based adversarial attack model, is illustrated in the flowchart below. Figure 4 As shown, the steps include:

[0099] Step S031: Construct the operation rule selection model in the generator using a deep Q-network;

[0100] Step S032: Construct the operation position selection model in the generator using the near-end strategy optimization algorithm;

[0101] Step S033: Construct a local deep neural network, i.e., a replacement model D, to simulate the target detector in a black-box scenario;

[0102] Step S034: Obtain feedback labels by querying the target detector, and train the alternative model using the binary cross-entropy loss function so that its output approximates the decision boundary of the target detector.

[0103] In this embodiment, the operation rule selection model in the generator constructed using a deep Q-network is constructed using a deep Q-network (DQN), whose state space is the observed state of the malware and whose action space is a predefined set of perturbation rules used to determine which perturbation type to use; the operation position selection model in the generator constructed using a proximal policy optimization algorithm is constructed using a proximal policy optimization (PPO) algorithm, whose input is the static features of code methods, including API call patterns and permission features, and whose output is the probability distribution of selecting a specific code block or method for perturbation; a local deep neural network, i.e., a substitute model D, is constructed to simulate the target detector f in a black-box scenario.

[0104] The alternative model D is trained by querying the object detector to obtain feedback labels and using a binary cross-entropy loss function to make its output approximate the decision boundary of the object detector. The loss function for training the alternative model D is defined as:

[0105] (1)

[0106] Where x represents the input software sample, f(x) represents the label (0 or 1) returned by the target detector, and D(x) represents the prediction probability of the alternative model.

[0107] In a preferred embodiment, step S04 involves optimizing the generator using a deep reinforcement learning algorithm to determine the optimal AST perturbation action, as shown in the flowchart below. Figure 5 As shown, the steps include:

[0108] Step S041: In each iteration, the operation position selection model is used to select k target methods through the Top-k sampling strategy;

[0109] Step S042: Use the operation rules to select the specific perturbation action for the selected target method and apply it to the sample to obtain the perturbated sample.

[0110] Step S043: Input the perturbed sample into the alternative model D for evaluation. Only when the alternative model is successfully avoided will the real target detector be queried.

[0111] Step S044: Construct the segmented reward function;

[0112] Step S045: Update the generator parameters based on the status information and / or action information and / or reward information.

[0113] In this embodiment, the experience replay buffer ℳ, DQN network parameters θ, and PPO network parameters ϕ are initialized. In each iteration, the operation position selection model is used to select k target methods through the Top-k sampling strategy. The operation rule selection model is used to select specific perturbation actions for the selected target methods and apply them to the samples to obtain perturbed samples x'. The perturbed samples x' are input into the substitution model D for evaluation. Only when the substitution model is successfully avoided is the real target detector f queried. The segmented reward function R is constructed: In order to guide the agent to generate effective adversarial samples, the segmented reward function is defined as shown in formula (2).

[0114] (2)

[0115] Where x' is the perturbed sample; R success The preset maximum reward for complete avoidance (i.e., simultaneously fooling both the alternative model D and the target model f); R sub P is the preset reward for only fooling the substitute model; α is the preset reward coefficient for the decrease in confidence score; invalid This is the preset penalty value for invalid disturbances.

[0116] Store information such as state, action, and reward (s, a, r, s') into the experience buffer.

[0117] In a preferred embodiment, step S045, updating the generator parameters based on state information and / or action information and / or reward information, is illustrated in the flowchart below. Figure 6 As shown, the steps include:

[0118] Step S0451: Select the network parameters of the model using the rule of minimizing the mean square Bellman error update operation;

[0119] Step S0452: Calculate the advantage function using the generalized advantage estimation algorithm;

[0120] Step S0453: Update the network parameters of the operation location selection model based on the advantage function and the maximization of the PPO-Clip objective function.

[0121] In this embodiment, the network parameter θ of the model (generator 1) is selected by minimizing the mean square Bellman error update operation rule, and the loss function is shown in formula (3).

[0122] (3)

[0123] Where Q(s,a;θ) is the current action value function, and γ is a preset discount factor.

[0124] Calculate the advantage function using generalized advantage estimation (GAE) As shown in formula (4).

[0125] (4)

[0126] Where δ t This refers to timing difference error.

[0127] Based on the advantage function, the network parameters ϕ of the operation position selection model (generator 2) are updated by maximizing the PPO-Clip objective function, as shown in Equation (5).

[0128] (5)

[0129] Where, r t (ϕ) represents the probability ratio between the old and new policies; ϵ is the truncation hyperparameter, used to limit the policy update magnitude to ensure training stability.

[0130] In a preferred embodiment, step S05 involves converting the selected AST perturbation action into structured cue words and generating code variants using LLM, as shown in the flowchart below. Figure 7 As shown, the steps include:

[0131] Step S051: Specify the role of the large language model as an expert programmer in the prompt words;

[0132] Step S052: Set specific AST modification requirements and constraints based on the optimal AST perturbation action;

[0133] Step S053: Provide valid AST transformations and their corresponding code examples in the prompt words to guide the output style of LLM;

[0134] Step S054: Combine the above parts into a complete structured prompt and the source code fragment to be modified, input them into LLM, and generate a code variant.

[0135] In this embodiment, role-playing instructions are constructed: the prompt word specifies that the Large Language Model (LLM) plays the role of an expert programmer, for example, "You are an expert Android developer specializing in Smali codeobfuscation.";

[0136] Construct a task description (set specific AST modification requirements and constraints based on the optimal AST perturbation actions): Describe the specific AST modification requirements and set high-level constraints. For example, if the rule is "method wrapping", describe it as "Wrap the invocation of method A inside a new method named B." and attach the constraint "Ensure the code is syntactically correct and preserves the original logic."

[0137] Example construction: Provide similar and effective AST transformations and their corresponding code examples in the prompt words to guide the output style of LLM;

[0138] Combine the above parts into a complete structured prompt, and input it along with the source code snippet to be modified into LLM to obtain the generated code variant.

[0139] In a preferred embodiment, step S06 involves compiling, verifying, and repairing the code generated by the LLM to generate an executable adversarial sample that retains malicious functionality. The flowchart is as follows: Figure 8 As shown, it includes:

[0140] Step S061: Compile the code snippets generated by LLM using a standard compiler;

[0141] Step S062: If the compilation is successful, verify whether the malicious function is retained through dynamic analysis. If it is retained, output as an adversarial sample.

[0142] Step S063: If compilation fails, extract the compiler's error log information;

[0143] Step S064: Feedback the error log and the problematic code as new prompt words to the LLM, requesting it to analyze the error and generate the fixed code;

[0144] Step S065: Repeat steps S061 to S064 until compilation is successful or the preset maximum number of retries is reached.

[0145] In this embodiment, the code snippets generated by the LLM are compiled using a standard compiler. If the compilation is successful, dynamic analysis is used to verify whether the malicious functions are retained. If they are retained, they are output as adversarial samples. If the compilation fails, the compiler's error log information is extracted. The error log and the problematic code are fed back to the LLM as new prompt words, requiring it to analyze the error and generate the corrected code (Self-Correction). The above steps are repeated until the compilation is successful or the preset maximum number of retries is reached.

[0146] The method described in this embodiment reports its effectiveness on the test set by attack success rate. Experiments were conducted on the Drebin and Malscan datasets. For each dataset, 200 malware samples were randomly selected as attack targets. Comparison methods include Mimicry and PGD, classic white-box adversarial attack methods suitable for the malware domain; HRAT, a reinforcement learning-based attack that perturbs function call graphs; and AdvDroidZero, a query-efficient black-box framework that uses perturbation selection trees.

[0147] Table 1 shows the detection performance of the method described in this embodiment (hereinafter referred to as LAM) on the Drebin and Malscan test datasets.

[0148] Table 1. Comparison of attack performance between LAM and baseline methods

[0149]

[0150] These results show that on the Drebin dataset, LAM achieves attack success rates of 98% and 97% against Drebin and APIGraph, respectively. This demonstrates that LAM can reliably generate effective adversarial perturbations, consistently outperforming Mimicry, PGD, and HRAT, while also outperforming AdvDroidZero.

[0151] On the Malscan dataset, LAM achieved attack success rates of 87% and 96% against Drebin and APIGraph, respectively. In contrast, Mimicry and PGD showed limited effectiveness, especially against APIGraph, while HRAT exhibited unstable behavior, failing to generate effective perturbations when attacking Drebin. AdvDroidZero performed well on APIGraph but showed poor stability across different datasets.

[0152] Therefore, the method (LAM) described in this embodiment of the invention has a high attack success rate on different datasets and its stability is significantly improved compared with other algorithms.

[0153] According to another embodiment of the present invention, a computer-readable storage medium is provided that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the malware adversarial sample generation method based on AST and LLM as described in any of the above embodiments.

[0154] According to another embodiment of the present invention, a malware adversarial sample generation system based on AST and LLM is provided, the structural diagram of which is shown below. Figure 9 As shown, it includes:

[0155] processor;

[0156] Memory;

[0157] And one or more programs, wherein the one or more programs are stored in memory and configured to be executed by the signal processing unit, the programs causing the computer to perform the AST and LLM-based malware adversarial sample generation method described in any of the above embodiments.

[0158] The methods described above according to the invention can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code originally stored on a remote recording medium or a non-transitory machine-readable medium and subsequently stored on a local recording medium, downloaded via a network. Thus, the methods described herein can be stored as software processing on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an AuIC or FPGA). It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods described herein. Furthermore, when a general-purpose computer accesses the code used to implement the processes shown herein, the execution of the code transforms the general-purpose computer into a dedicated computer for performing the processes shown herein.

[0159] Of course, those skilled in the art should recognize that the above embodiments are only used to illustrate the present invention and are not intended to limit the present invention. Any changes or modifications to the above embodiments that are within the scope of the present invention will fall within the protection scope of the present invention. < / receiver> < / service> < / activity>

Claims

1. A method for generating adversarial malware samples based on AST and LLM, characterized in that, include: Parse malware samples to obtain their Abstract Syntax Tree (AST); A set of semantically preserved perturbation rules is constructed based on the AST structure; Construct an adversarial attack model based on deep learning; the generator includes an operation rule selection model and an operation position selection model, and the discriminator serves as an alternative model to simulate a target detector; The generator is optimized using deep reinforcement learning algorithms to determine the optimal AST perturbation action; The selected AST perturbation actions are transformed into structured cue words and code variants are generated using LLM; Compile, verify, and repair the code generated by LLM to generate an executable adversarial sample that retains malicious functionality.

2. The method for generating adversarial malware samples based on AST and LLM according to claim 1, characterized in that, The process of parsing malware samples to obtain their Abstract Syntax Tree (AST) includes: Use decompilation tools to decompile malware samples into code files; The code file is parsed using a parser to generate an Abstract Syntax Tree (AST).

3. The method for generating adversarial malware samples based on AST and LLM according to claim 1, characterized in that, The step of constructing a semantically preserved perturbation rule set based on the AST structure includes: Identify key non-leaf nodes in the AST, including expression nodes, statement nodes, and method declaration nodes, as potential perturbation injection points; Construct code-level AST operation rules, including modifying If statement conditions, adding meaningless AST nodes, adding input parameters, inserting dead code, method wrapping, method overriding, string encryption, and reflection call replacement; Data manipulation rules for building metadata files, including insertion or renaming, as well as insertion request permissions and hardware component declarations; A set of semantically preserving perturbation rules is constructed based on the AST operation rules at the code level and the data operation rules of the metadata file.

4. The method for generating adversarial malware samples based on AST and LLM according to claim 1, characterized in that, The construction of the deep learning-based adversarial attack model includes the following steps: A deep Q-network is used to construct the operation rule selection model in the generator; A proximal strategy optimization algorithm is used to construct the operation position selection model in the generator; Construct a local deep neural network, i.e., a replacement model D, to simulate the target detector in a black-box scenario; The alternative model is trained by querying the object detector to obtain feedback labels and using the binary cross-entropy loss function, so that its output approximates the decision boundary of the object detector.

5. The method for generating adversarial malware samples based on AST and LLM according to claim 4, characterized in that, The step of optimizing the generator using a deep reinforcement learning algorithm to determine the optimal AST perturbation action includes the following steps: In each iteration, the operation position selection model is used to select k target methods through a Top-k sampling strategy; The model is selected using operational rules to choose specific perturbation actions for the selected target method and applied to the samples to obtain perturbed samples. The perturbated sample is input into the alternative model D for evaluation, and the real target detector is queried only when the alternative model is successfully evaded. Construct a segmented reward function; Update the generator parameters based on status information and / or action information and / or reward information.

6. The method for generating adversarial malware samples based on AST and LLM according to claim 5, characterized in that, The step of updating the generator parameters based on state information and / or action information and / or reward information includes the following steps: The network parameters of the model are selected using the rule of minimizing the mean square Bellman error update operation. The advantage function is calculated using the generalized advantage estimation algorithm; The network parameters of the operation location selection model are updated based on the advantage function and the objective function of maximizing PPO-Clip.

7. The method for generating adversarial malware samples based on AST and LLM according to claim 1, characterized in that, The process of converting selected AST perturbation actions into structured cue words and generating code variants using LLM includes the following steps: Specify the role of the large language model as an expert programmer in the prompt words; Specific AST modification requirements and constraints are set based on the optimal AST perturbation action; Provide valid AST transformations and their corresponding code examples in the prompts to guide the output style of LLM; Combine the above parts into a complete structured prompt and input the source code snippet to be modified into LLM to generate a code variant.

8. The method for generating adversarial malware samples based on AST and LLM according to claim 1, characterized in that, The process of compiling, verifying, and repairing the code generated by LLM to generate an executable adversarial sample that retains malicious functionality includes: The code snippets generated by LLM are compiled using a standard compiler; If compilation is successful, dynamic analysis is used to verify whether the malicious functions are retained. If they are retained, the output is an adversarial sample. If compilation fails, extract the compiler's error log information; The error log and the problematic code are fed back to the LLM as new prompt words, requesting it to analyze the error and generate the fixed code. Repeat the above steps until compilation is successful or the preset maximum number of retries is reached.

9. A computer-readable storage medium storing a computer program for electronic data interchange, wherein, The computer program causes the computer to perform the method as described in any one of claims 1-8.

10. A malware adversarial sample generation system based on AST and LLM, characterized in that, include: processor; Memory; as well as One or more programs, wherein the one or more programs are stored in memory and configured to be executed by the processor, the programs causing the computer to perform the method as described in any one of claims 1-8.

Images