Malicious software detection method and device based on large language model

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to a malicious software detection method and device based on a large language model. According to the method, the large language model-based API call representation generation method is introduced, so that the malware detection accuracy and efficiency are remarkably improved. According to the method, the high-quality explanatory text is generated for each API call by using the large language model, the explanatory text is used as the representation of the API call, and the representations are directly used through the pre-trained word embedding model without depending on a traditional API sequence data set for training, so that the model training process is simplified. Due to the rich knowledge base and the powerful text generation capability of the large language model, the generated API representation has higher quality and generalization capability, the problem of data drift can be effectively solved, high stability is kept, and the malicious software detection efficiency and performance are improved.

Description

Technical Field

[0001] The present disclosure belongs to the field of nuclear power technology, and specifically relates to a malware detection method and device based on a large language model. Background Art

[0002] With the widespread popularity of the Internet and the rapid development of information technology, malware has gradually become a major threat to the field of network and computer security. There are many types of malware, including viruses, Trojans, worms, etc., which pose a serious threat to the information security of individuals and enterprises due to their strong concealment and destructiveness. In view of this, how to effectively detect and defend against malware has become an important topic in information security research.

[0003] At present, malware detection technology is mainly divided into two categories: static analysis and dynamic analysis. Static analysis methods examine the code or binary files of malware to find the characteristics of malicious behavior. However, this method is easily interfered by code obfuscation and encryption technology, and it is difficult to deal with disguised malware. In contrast, dynamic analysis methods run malware in a controlled environment (such as a sandbox) and monitor its dynamic behavior during runtime (such as API call sequences) to detect its potential threats. Dynamic analysis methods can not only effectively deal with code obfuscation and packaging technology, but also provide richer behavioral characteristics. Therefore, they have been widely used in practical applications.

[0004] In recent years, with the successful application of deep learning technology in the field of natural language processing, models based on deep learning have gradually been introduced into the field of malware detection, especially for analyzing and classifying the dynamic behavior of malware. There is a certain similarity in the encoding of malware API call sequences and text sequences in natural language, which makes many models in natural language processing (such as recurrent neural networks, long short-term memory networks, etc.) applied to malware detection. Detection methods based on these models show relatively excellent performance in the task of API call sequence classification.

[0005] However, current malware detection methods based on deep learning still have certain limitations. On the one hand, the feature representations obtained by these methods during the training phase are often too dependent on specific data sets, resulting in insufficient generalization of the model when facing new malware. On the other hand, existing detection methods are sensitive to the concept drift problem. With the continuous evolution of malware and the iterative updates of detection tools, the API call sequence also changes, which makes it difficult for the model to effectively capture the behavioral characteristics of the new API, thus affecting the accuracy of detection. Summary of the invention

[0006] In order to overcome the problems existing in the related art, a malware detection method and device based on a large language model are provided.

[0007] According to one aspect of an embodiment of the present disclosure, a malware detection method based on a large language model is provided, the method comprising:

[0008] Step 1, data set construction and preprocessing: widely collect normal application samples and malware samples running on the operating system platform to form an initial data set, and then clean the data set;

[0009] Step 2, data set division: divide the cleaned data set reasonably into training sample set and verification sample set;

[0010] Step 3, API call sequence extraction: Execute each sample in the dataset in the analysis environment, capture and record the API call sequence of the sample;

[0011] Step 4, sequence preprocessing: perform deduplication processing on the API call sequences in the training sample set and the validation sample set to eliminate consecutive repeated call patterns, and then perform truncation and padding operations on the deduplicated sequences;

[0012] Step 5, API dictionary construction: Statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and construct the API dictionary based on them;

[0013] Step 6, text vectorization conversion: construct a prompt template, use a large language model to generate an explanatory text description for each API in the API dictionary, then use a pre-trained word embedding model to convert the text description into a vector form, and establish a mapping relationship table between each API and the vector;

[0014] Step 7, model training and optimization: according to the mapping relationship table, the API call sequence in the training sample set is converted into a vector representation, and input into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training, and the parameters of the hybrid neural network are optimized using the verification sample set to obtain the final malware detection model;

[0015] Step 8, malware detection: After extracting and processing the API call sequence of the sample to be tested, convert the processed sequence into a vector representation according to the API and vector conversion table, and input it into the trained malware detection model to predict whether the sample to be tested is malware.

[0016] In a possible implementation, in step 1, in order to reduce potential quality deviations in the data set, the normal application samples and malware samples are collected across multiple data sources.

[0017] In a possible implementation, in step 1, the step of cleaning the data set includes:

[0018] Step 11, sample deduplication: by calculating the hash value of the sample, the samples in the data set are deduplicated to eliminate duplicate samples;

[0019] Step 12, normal software sample verification: Submit normal application samples to VirusTotal for malware detection, and exclude samples marked as malicious by more than one virus reporting engine.

[0020] In a possible implementation, the analysis environment in step 3 is a sandbox environment built based on the dynamic binary instrumentation tool DynamoRIO.

[0021] In one possible implementation, the large language model used in step 6 is GPT-4o, and the pre-trained word embedding model is Jina-embeddings-v3, and the dimension of its output vector is set to 1024 dimensions.

[0022] In a possible implementation, in step 7, a binary cross entropy loss function is used during supervised learning training of the hybrid neural network.

[0023] According to one aspect of an embodiment of the present disclosure, a malware detection device based on a large language model is provided, the device comprising:

[0024] A data set construction and preprocessing module is used to widely collect normal application samples and malware samples running on the operating system platform to form an initial data set, and then clean the data set;

[0025] The data set partitioning module is used to reasonably divide the cleaned data set into a training sample set and a validation sample set;

[0026] An API call sequence extraction module is used to execute each sample in the data set in the analysis environment, capture and record the API call sequence of the sample;

[0027] The sequence preprocessing module is used to perform deduplication processing on the API call sequences in the training sample set and the validation sample set to eliminate consecutively repeated call patterns, and then perform truncation and padding operations on the deduplicated sequences;

[0028] The API dictionary building module is used to statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and build the API dictionary based on them;

[0029] A text vectorization conversion module is used to build a prompt template, generate an explanatory text description for each API in the API dictionary using a large language model, and then use a pre-trained word embedding model to convert the text description into a vector form, and establish a mapping relationship table between each API and the vector;

[0030] A model training and optimization module, for converting the API call sequence in the training sample set into a vector representation according to the mapping relationship table, and inputting it into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training, and optimizing the parameters of the hybrid neural network using a verification sample set to obtain a final malware detection model;

[0031] The malware detection module is used to extract and process the API call sequence of the sample to be tested, convert the processed sequence into a vector representation according to the API and vector conversion table, and input it into the trained malware detection model to predict whether the sample to be tested is malware.

[0032] According to another aspect of an embodiment of the present disclosure, a malware detection device based on a large language model is provided, the device comprising:

[0033] processor;

[0034] a memory for storing processor-executable instructions;

[0035] Wherein, the processor is configured to execute the above method.

[0036] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0037] The beneficial effect of the present disclosure is that the present disclosure significantly improves the accuracy and efficiency of malware detection by introducing a method for generating API call representations based on a large language model. By using a large language model to generate high-quality explanatory text for each API call and using it as the representation of the API call, these representations are directly used through a pre-trained word embedding model without relying on traditional API sequence datasets for training, thereby simplifying the model training process. Due to the rich knowledge base and powerful text generation capabilities of the large language model, the generated API representation has higher quality and generalization capabilities, can effectively deal with data drift problems, maintain strong stability, and improve the efficiency and performance of malware detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flowchart of a malware detection method based on a large language model shown in an embodiment of the present disclosure.

[0039] Figure 2 It is a training flow chart of a hybrid neural network model shown in an embodiment of the present disclosure.

[0040] Figure 3 It is a block diagram of a malware detection device based on a large language model shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0041] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0042] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0043] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0044] Figure 1 is a flowchart of a malware detection method based on a large language model shown in an embodiment of the present disclosure. The method can be executed by a terminal device, wherein the terminal device can be a server, a desktop computer, a laptop computer, etc. The embodiment of the present disclosure does not limit the type of the terminal device. Figure 1 As shown, the method includes:

[0045] Step 1, data set construction and preprocessing: widely collect normal application samples and malware samples running on the operating system platform to form an initial data set. This disclosure does not limit the type of operating system platform. Subsequently, the data set is cleaned to remove invalid and redundant data to ensure the quality and reliability of the data set.

[0046] Step 2, data set division: The cleaned data set is reasonably divided into training sample sets and verification sample sets to facilitate subsequent model training and performance verification.

[0047] Step 3, API call sequence extraction: Execute each sample in the dataset in a specially built analysis environment, capture and record the API call sequence of the sample, and provide basic data for subsequent feature extraction and model training. For example, about 80% of the collected software samples can be selected as the training sample set. These samples will be used to train the malware detection model so that it can learn and identify the characteristics of malware. About 20% of the remaining samples are selected as the validation set. The validation set is used to adjust the model parameters and select the best model configuration during the model training process to prevent overfitting.

[0048] The deduplicated API call sequences are truncated, and only the first 10,000 API call sequences are retained as input data. For API call sequences with a length of less than 10,000, the "PAD" tag is used for padding to ensure that the length of all input sequences is consistent. In addition, for API call sequence samples not included in the API dictionary, the "UNK" tag is used to replace them.

[0049] Step 4, sequence preprocessing: deduplicate the API call sequences in the training sample set and the validation sample set to eliminate consecutively repeated call patterns. Then, truncate and pad the deduplicated sequences to meet the model input requirements.

[0050] Step 5, API dictionary construction: Statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and build an API dictionary based on them.

[0051] For example, the present disclosure can traverse all API call sequences generated in the training sample set, and include each unique API call sequence into a set, thereby forming a deduplicated API dictionary. To handle special cases, the present disclosure also adds two special tags "PAD" and "UNK" to the dictionary, which are used for padding operations after truncation of the API call sequence and for processing APIs that have not appeared in the training set, respectively.

[0052] Step 6, text vectorization conversion: Construct a prompt template and use a large language model to generate an explanatory text description for each API in the API dictionary. Then, use a pre-trained word embedding model to convert the text description into a vector form and establish a mapping relationship table between each API and the vector. In this step, the pre-processed API call sequence is converted into a vector form by using a pre-built mapping relationship table between the API and the vector representation. This vectorization operation ensures that the sequence data can be effectively recognized and processed by the hybrid neural network.

[0053] For example, in step 6, in order to improve the accuracy of large language models when describing API functions, the present invention designs a set of refined prompt templates based on the theory and practical experience of prompt engineering. The template integrates three parts: identity role prompts, content restrictions, and word count restrictions. Specifically, the identity role prompts are used to establish the professional role of the model when generating descriptions (for example: "You are a professional malware analysis expert"), ensuring the professionalism and relevance of the output content. Content restrictions ensure the conciseness of the model output and the uniformity of the format of the technical documentation (for example: "The description does not contain specific code examples or special symbols"). In addition, the word count limit is intended to ensure the refinement of the model output and avoid redundant information, thereby enhancing the readability and processing efficiency of the API function description (for example: "The description does not exceed 100 words"). The prompt template design disclosed in the present invention enables LLM to output both accurate and efficient API function descriptions. See Table 1 for examples of prompt template content.

[0054] Table 1 Large model prompt template

[0055]

[0056] Step 7, model training and optimization: see Figure 2 , according to the mapping relationship table, the API call sequence in the training sample set is converted into a vector representation, and input into a hybrid neural network based on a bidirectional gated recurrent unit (Bidirectional Gated Recurrent Unit, Bi-GRU) and a convolutional neural network (Convolutional Neural Network, CNN) for supervised learning training. At the same time, the parameters of the hybrid neural network are optimized using the verification sample set to obtain the final malware detection model. Through the supervised learning mechanism, the network is trained to generate a malware detection model with high detection performance. The performance evaluation of the model is carried out by using the verification sample set, and the model parameters are optimized and adjusted according to the evaluation results until the optimal malware detection model is obtained. Finally, the detection effect of the model is comprehensively evaluated through the test set to verify the accuracy and generalization ability of the model.

[0057] Step 8, malware detection: Perform the same API call sequence extraction and processing process on the sample to be tested. According to the API and vector conversion table, the processed sequence is converted into a vector representation and input into the trained detection model to predict whether the sample is malware.

[0058] In one possible implementation, in step 1, in order to reduce the potential quality deviation in the data set, the normal application samples and malware samples are collected across multiple data sources, including CNET software store, VirusShare, ANYRUN website and other platforms, so as to ensure the extensiveness of the samples and enhance the adaptability and robustness of the model in practical applications.

[0059] In a possible implementation, in step 1, the step of cleaning the data set includes:

[0060] Step 11, sample deduplication: Deduplication of API call sequence samples in the dataset is performed by calculating the hash value of each API call sequence sample to eliminate duplicate samples. Duplicate files are identified and deleted by comparing hash values ​​to ensure the independence and diversity of the sample dataset.

[0061] Step 12, normal software sample verification: Submit normal application samples to VirusTotal for malware detection, and exclude samples marked as malicious by more than one virus reporting engine to ensure the purity of the sample data set.

[0062] In a possible implementation, the analysis environment in step 3 is a sandbox environment built based on the dynamic binary instrumentation tool DynamoRIO, which is used to capture the kernel-mode system function call sequence during the sample execution process.

[0063] In one possible implementation, the large language model used in step 6 is GPT-4o, and the pre-trained word embedding model is Jina-embeddings-v3, and the dimension of its output vector is set to 1024 dimensions.

[0064] In a possible implementation, in step 7, a binary cross entropy loss function is used during supervised learning training of the hybrid neural network.

[0065] According to one aspect of an embodiment of the present disclosure, a malware detection device based on a large language model is provided, the device comprising:

[0066] A data set construction and preprocessing module is used to widely collect normal application samples and malware samples running on the operating system platform to form an initial data set, and then clean the data set;

[0067] The data set partitioning module is used to reasonably divide the cleaned data set into a training sample set and a validation sample set;

[0068] An API call sequence extraction module is used to execute each sample in the data set in the analysis environment, capture and record the API call sequence of the sample;

[0069] The sequence preprocessing module is used to perform deduplication processing on the API call sequences in the training sample set and the validation sample set to eliminate consecutively repeated call patterns, and then perform truncation and padding operations on the deduplicated sequences;

[0070] The API dictionary building module is used to statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and build the API dictionary based on them;

[0071] A text vectorization conversion module is used to build a prompt template, generate an explanatory text description for each API in the API dictionary using a large language model, and then use a pre-trained word embedding model to convert the text description into a vector form, and establish a mapping relationship table between each API and the vector;

[0072] A model training and optimization module, for converting the API call sequence in the training sample set into a vector representation according to the mapping relationship table, and inputting it into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training, and optimizing the parameters of the hybrid neural network using a verification sample set to obtain a final malware detection model;

[0073] The malware detection module is used to extract and process the API call sequence of the sample to be tested, convert the processed sequence into a vector representation according to the API and vector conversion table, and input it into the trained malware detection model to predict whether the sample to be tested is malware.

[0074] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0075] Figure 3 1900 is a block diagram of a malware detection device based on a large language model according to an embodiment of the present disclosure. For example, the device 1900 may be provided as a server. Figure 3 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0076] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0077] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0078] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0079] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0080] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0081] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0082] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0083] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0084] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0085] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0086] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A malware detection method based on a large language model, characterized in that: The method comprises: Step 1, data set construction and preprocessing: widely collect normal application samples and malware samples running on the operating system platform to form an initial data set, and then clean the data set; Step 2, data set division: divide the cleaned data set reasonably into training sample set and verification sample set; Step 3, API call sequence extraction: Execute each sample in the dataset in the analysis environment, capture and record the API call sequence of the sample; Step 4, sequence preprocessing: perform deduplication processing on the API call sequences in the training sample set and the validation sample set to eliminate consecutive repeated call patterns, and then perform truncation and padding operations on the deduplicated sequences; Step 5, API dictionary construction: Statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and construct the API dictionary based on them; Step 6, text vectorization conversion: construct a prompt template, use a large language model to generate an explanatory text description for each API in the API dictionary, then use a pre-trained word embedding model to convert the text description into a vector form, and establish a mapping relationship table between each API and the vector; Step 7, model training and optimization: according to the mapping relationship table, the API call sequence in the training sample set is converted into a vector representation, and input into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training, and the parameters of the hybrid neural network are optimized using the verification sample set to obtain the final malware detection model; Step 8, malware detection: After extracting and processing the API call sequence of the sample to be tested, convert the processed sequence into a vector representation according to the API and vector conversion table, and input it into the trained malware detection model to predict whether the sample to be tested is malware.

2. The method according to claim 1, characterized in that In step 1, in order to reduce potential quality bias in the dataset, the normal application samples and malware samples are collected across multiple data sources.

3. The method according to claim 1, characterized in that In step 1, the steps to clean the data set include: Step 11, sample deduplication: by calculating the hash value of the sample, the samples in the data set are deduplicated to eliminate duplicate samples; Step 12, normal software sample verification: Submit normal application samples to VirusTotal for malware detection, and exclude samples marked as malicious by more than one virus reporting engine.

4. The method according to claim 1, characterized in that: In step 3, the analysis environment is a sandbox environment built based on the dynamic binary instrumentation tool DynamoRIO.

5. The method according to claim 1, characterized in that: The large language model used in step 6 is GPT-4o, and the pre-trained word embedding model is Jina-embeddings-v3, and the dimension of its output vector is set to 1024 dimensions.

6. The method according to claim 1, characterized in that In step 7, a binary cross entropy loss function is used during supervised learning training of the hybrid neural network.

7. A malware detection device based on a large language model, characterized in that: The device comprises: A data set construction and preprocessing module is used to widely collect normal application samples and malware samples running on the operating system platform to form an initial data set, and then clean the data set; The data set partitioning module is used to reasonably divide the cleaned data set into a training sample set and a validation sample set; An API call sequence extraction module is used to execute each sample in the data set in the analysis environment, capture and record the API call sequence of the sample; The sequence preprocessing module is used to perform deduplication processing on the API call sequences in the training sample set and the validation sample set to eliminate consecutively repeated call patterns, and then perform truncation and padding operations on the deduplicated sequences; The API dictionary building module is used to statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and build the API dictionary based on them; A text vectorization conversion module is used to build a prompt template, generate an explanatory text description for each API in the API dictionary using a large language model, and then use a pre-trained word embedding model to convert the text description into a vector form, and establish a mapping relationship table between each API and the vector; A model training and optimization module, for converting the API call sequence in the training sample set into a vector representation according to the mapping relationship table, and inputting it into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training, and optimizing the parameters of the hybrid neural network using a verification sample set to obtain a final malware detection model; The malware detection module is used to extract and process the API call sequence of the sample to be tested, convert the processed sequence into a vector representation according to the API and vector conversion table, and input it into the trained malware detection model to predict whether the sample to be tested is malware.

8. A malware detection device based on a large language model, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 6.

9. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images