Malware detection method and device based on large language model

Abstract

The present disclosure belongs to the technical field of nuclear power and specifically relates to a malware detection method and device based on a large language model. The present disclosure introduces an API call representation generation method based on a large language model, significantly improving the accuracy and efficiency of malware detection. By using a large language model to generate high-quality explanatory text for each API call and using the explanatory text as the representation of the API call, the pre-trained word embedding model directly uses these representations without relying on traditional API sequence datasets for training, thereby simplifying the model training process. Due to the rich knowledge base and powerful text generation capability of the large language model, the generated API representation has higher quality and generalization capability, can effectively deal with the data drift problem, maintain strong stability, and improve the efficiency and performance of malware detection.

Description

TECHNICAL FIELD

[0001] The present disclosure belongs to the technical field of nuclear power, and particularly relates to a malware detection method and device based on a large language model. BACKGROUND

[0002] With the widespread popularity of the Internet and the rapid development of information technology, malware has gradually become a major threat in the field of network and computer security. Malware is diverse, covering viruses, Trojans, worms and other forms, and with its strong concealment and great destructive characteristics, it poses a serious threat to personal and enterprise information security. In view of this, how to effectively detect and defend against malware has become an important topic in information security research.

[0003] Currently, malware detection techniques mainly fall into two categories: static analysis and dynamic analysis. Static analysis methods examine the code or binary files of malware to find features of malicious behavior. However, this method is susceptible to code obfuscation and encryption techniques, making it difficult to deal with disguised malware. In contrast, dynamic analysis methods run malware in a controlled environment (such as a sandbox) to monitor its dynamic behavior (such as API call sequences) during runtime to detect potential threats. Dynamic analysis methods not only effectively deal with code obfuscation and packing techniques, but also provide more rich behavioral features, so they are widely used in practical applications.

[0004] In recent years, with the successful application of deep learning techniques in the field of natural language processing, models based on deep learning have been gradually introduced into the field of malware detection, especially for analyzing and classifying the dynamic behavior of malware. The API call sequence of malware has some similarities in encoding with the text sequence in natural language, which makes many models in natural language processing (such as recurrent neural networks, long short-term memory networks, etc.) applied to malware detection. Detection methods based on these models have shown excellent performance in API call sequence classification tasks.

[0005] However, current deep learning-based malware detection methods still have certain limitations. On the one hand, the feature representations obtained by these methods in the training phase tend to be overly dependent on specific data sets, resulting in insufficient generalization ability of the model when facing new malware. On the other hand, existing detection methods are sensitive to concept drift problems. As malware continues to evolve and detection tools are iteratively updated, API call sequences also change, making it difficult for the model to effectively capture the behavior characteristics of new APIs, thereby affecting the accuracy of detection. SUMMARY

[0006] To overcome the problems in the related art, a malware detection method and device based on a large language model are provided.

[0007] According to an aspect of the embodiments of the present disclosure, a malware detection method based on a large language model is provided, and the method comprises:

[0008] Step 1, data set construction and preprocessing: normal application program samples and malware samples running on an operating system platform are collected extensively to form an initial data set, and then the data set is cleaned;

[0009] Step 2, data set division: the cleaned data set is logically divided into a training sample set and a validation sample set;

[0010] Step 3, API call sequence extraction: each sample in the data set is executed in an analysis environment, and the API call sequence of the sample is captured and recorded;

[0011] Step 4, sequence preprocessing: the API call sequences in the training sample set and the validation sample set are de-duplicated to eliminate continuous repeated call patterns, and then truncation and padding operations are performed on the de-duplicated sequences;

[0012] Step 5, API dictionary construction: the API call sequences in the preprocessed training sample set are statistically analyzed, and all unique API call types are extracted to construct an API dictionary;

[0013] Step 6, text vectorization conversion: a prompt template is constructed, a large language model is used to generate an explanatory text description for each API in the API dictionary, and then a pre-trained word embedding model is used to convert the text description into a vector form, and a mapping relationship table between the APIs and the vectors is established;

[0014] Step 7, model training and optimization: according to the mapping relationship table, the API call sequences in the training sample set are converted into vector representations and input into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training, and the parameters of the hybrid neural network are optimized using the validation sample set to obtain a final malware detection model;

[0015] Step 8, malware detection: after the API call sequence extraction and processing of the to-be-tested sample are performed, the processed sequence is converted into a vector representation according to the API-to-vector conversion table, and is input into the trained malware detection model to predict whether the to-be-tested sample is malware.

[0016] In a possible implementation, in step 1, to reduce potential quality bias in the data set, the normal application program samples and the malware samples are collected across multiple data sources.

[0017] In a possible implementation, in step 1, the step of cleaning the dataset comprises:

[0018] Step 11, sample deduplication: the samples in the dataset are deduplicated by calculating the hash value of the samples to eliminate duplicate samples;

[0019] Step 12, normal software sample verification: the normal application sample is submitted to VirusTotal for malware detection, and the sample marked as malicious by more than one virus reporting engine is excluded.

[0020] In a possible implementation, in step 3, the analysis environment is a sandbox environment constructed based on a dynamic binary instrumentation tool DynamoRIO.

[0021] In a possible implementation, in step 6, the large language model used is GPT-4o, and the pre-trained word embedding model is Jina-embeddings-v3, and the dimension of the output vector is set to 1024 dimensions.

[0022] In a possible implementation, in step 7, during the supervised learning training process of the hybrid neural network, a binary cross-entropy loss function is used.

[0023] According to an aspect of an embodiment of the present disclosure, a malware detection device based on a large language model is provided, and the device comprises:

[0024] A dataset construction and preprocessing module is configured to collect normal application samples and malware samples running on an operating system platform extensively to form an initial dataset, and then clean the dataset;

[0025] A dataset division module is configured to divide the cleaned dataset into a training sample set and a verification sample set;

[0026] An API call sequence extraction module is configured to execute each sample in the dataset in an analysis environment, capture and record the API call sequence of the sample;

[0027] A sequence preprocessing module is configured to deduplicate the API call sequences in the training sample set and the verification sample set to eliminate continuous repeated call patterns, and then perform truncation and padding operations on the deduplicated sequences;

[0028] An API dictionary construction module is configured to statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and construct an API dictionary accordingly;

[0029] The text vectorization conversion module is configured to construct a prompt template, generate an explanatory text description for each API in an API dictionary using a large language model, and then convert the text description into a vector form using a pre-trained word embedding model to establish a mapping relationship table between the APIs and the vectors.

[0030] The model training and optimization module is configured to convert API call sequences in a training sample set into vector representations according to the mapping relationship table, input the API call sequences into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training, and optimize the parameters of the hybrid neural network using a validation sample set to obtain a final malware detection model.

[0031] The malware detection module is configured to convert a processed sequence into a vector representation according to an API and vector conversion table after performing API call sequence extraction and processing on a to-be-tested sample, and input the processed sequence into the trained malware detection model to predict whether the to-be-tested sample is malware.

[0032] According to another aspect of the embodiments of the present disclosure, a malware detection device based on a large language model is provided, and the device includes:

[0033] a processor;

[0034] a memory for storing processor-executable instructions;

[0035] The processor is configured to perform the above method.

[0036] According to another aspect of the embodiments of the present disclosure, a non-volatile computer-readable storage medium having computer program instructions stored thereon is provided, and the computer program instructions are executed by a processor to implement the above method.

[0037] The present disclosure has the beneficial effect of significantly improving the accuracy and efficiency of malware detection by introducing an API call representation generation method based on a large language model. By using a large language model to generate high-quality explanatory text for each API call and using these representations directly through a pre-trained word embedding model without relying on traditional API sequence datasets for training, the model training process is simplified. Due to the rich knowledge base and powerful text generation capability of the large language model, the generated API representation has higher quality and generalization ability, can effectively deal with the data drift problem, maintains strong stability, and improves the efficiency and performance of malware detection. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 is a flowchart of a malware detection method based on a large language model according to an embodiment of the present disclosure.

[0039] Figure 2 is a training flowchart of a hybrid neural network model according to an embodiment of the present disclosure.

[0040] Figure 3 is a block diagram of a malware detection apparatus based on a large language model according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0041] The present disclosure will be described in further detail below with reference to the drawings and specific embodiments.

[0042] Unless otherwise defined, technical and scientific terms used in the present disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs; the terminology used in the present disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure; the term "comprising" and any variation thereof, used in the present disclosure, is intended to cover not excluding any additional item, any additional step, etc. It will be readily apparent to one of ordinary skill in the art that the present disclosure described herein can be practiced with embodiments other than those described in detail. The present disclosure includes all such alternatives and modifications.

[0043] Reference in the specification to "an embodiment" or "the embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the disclosure. The appearances of the phrase "in an embodiment" or "in the embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily all directed to the same embodiment, or to a single alternative embodiment. It will be readily apparent to one of ordinary skill in the art that the embodiments described herein can be combined with embodiments not expressly described but known to one of ordinary skill in the art.

[0044] Figure 1 is a flowchart of a malware detection method based on a large language model according to an embodiment of the present disclosure. The method can be performed by a terminal device, which can be a server, a desktop computer, a notebook computer, etc., and the type of the terminal device is not limited by the present disclosure. As shown in Figure 1 the method includes:

[0045] Step 1, data set construction and preprocessing: normal application samples and malware samples running on an operating system platform are collected to form an initial data set, and the type of the operating system platform is not limited by the present disclosure. Then, the data set is cleaned to remove invalid and redundant data, ensuring the quality and reliability of the data set.

[0046] Step 2, data set division: the cleaned data set is logically divided into a training sample set and a validation sample set to facilitate subsequent model training and performance verification.

[0047] Step 3, API call sequence extraction: Each sample in the dataset is executed in a specially built analysis environment, capturing and recording the API call sequence of the sample, providing basic data for subsequent feature extraction and model training. For example, about 80% of the samples collected from the software samples can be selected as the training sample set. These samples will be used to train the malware detection model, so that it can learn and identify the features of malware. About 20% of the remaining samples are selected as the verification set. The verification set is used to adjust the model parameters and select the best model configuration during model training to prevent overfitting.

[0048] The de-duplicated API call sequence is truncated to retain only the first 10,000 API call sequences as input data. For API call sequences with a length less than 10,000, a "PAD" marker is used for padding to ensure that all input sequences have the same length. In addition, for API call sequence samples not included in the API dictionary, an "UNK" marker is used for replacement.

[0049] Step 4, sequence preprocessing: The API call sequences in the training sample set and the verification sample set are de-duplicated to eliminate consecutive repeated call patterns, and then the de-duplicated sequences are truncated and padded to meet the requirements of model input.

[0050] Step 5, API dictionary construction: statistical analysis of the API call sequences in the pre-processed training sample set to extract all unique API call types, and construct an API dictionary accordingly.

[0051] For example, the present disclosure can traverse all API call sequences generated in the training sample set, and include each unique API call sequence in a set, thereby forming a de-duplicated API dictionary. To handle special cases, the present disclosure also adds two special markers "PAD" and "UNK" to the dictionary, which are used for padding after truncation of the API call sequence and handling of API that does not appear in the training set.

[0052] Step 6, text vectorization conversion: build a prompt template and use a large language model to generate an explanatory text description for each API in the API dictionary. Then, use a pre-trained word embedding model to convert the text description into a vector form, and establish a mapping relationship table between the APIs and the vectors. In this step, by using the pre-constructed mapping relationship table between the APIs and the vector representations, the pre-processed API call sequence is converted into a vector form. This vectorization operation ensures that the sequence data can be effectively recognized and processed by the hybrid neural network.

[0053] For example, in step 6, in order to improve the accuracy of large language models in describing API functions, the present application designs a set of refined prompt templates based on the theory and practical experience of prompt engineering. The template combines identity role prompts, content restrictions, and word limits. Specifically, the identity role prompt is used to establish the professional role of the model in generating descriptions (for example: "You are a professional malware analysis expert"), ensuring the professionalism and relevance of the output content. Content restrictions ensure the conciseness of the model output and the uniformity of the technical document format (for example: "Descriptions do not contain specific code examples or special symbols"). In addition, word limits aim to ensure the refinement of the model output, avoiding redundant information, thereby enhancing the readability and processing efficiency of API function descriptions (for example: "Description word limit is not more than 100 words"). The prompt template design of the present disclosure enables the LLM to output accurate and efficient API function descriptions. See Table 1 for examples of prompt template content.

[0054] Table 1: Large Model Prompt Template

[0055]

[0056] Step 7, model training and optimization: see Figure 2 According to the mapping relationship table, the API call sequence in the training sample set is converted into a vector representation and input into a hybrid neural network based on Bidirectional Gated Recurrent Unit (Bi-GRU) and Convolutional Neural Network (CNN) for supervised learning training. At the same time, the parameters of the hybrid neural network are optimized using the validation sample set to obtain the final malware detection model. Through the supervised learning mechanism, the network is trained to generate a malware detection model with high detection performance. The performance evaluation of the model is carried out by using the validation sample set, and according to the evaluation results, the model parameters are optimized and adjusted until the optimal malware detection model is obtained. Finally, the detection effect of the model is comprehensively evaluated by the test set to verify the accuracy and generalization ability of the model.

[0057] Step 8, malware detection: the same API call sequence extraction and processing process is performed on the test sample. According to the API and vector conversion table, the processed sequence is converted into a vector representation and input into the trained detection model to predict whether the sample is malware.

[0058] In a possible implementation, in step 1, to reduce potential quality bias in the data set, the normal application program samples and malware samples are collected across multiple data sources, including CNET software store, VirusShare, ANYRUN website and other platforms, so as to ensure the universality of the samples and enhance the adaptability and robustness of the model in actual application.

[0059] In a possible implementation, in step 1, the step of cleaning the data set includes:

[0060] Step 11, sample deduplication: the API call sequence samples in the data set are deduplicated by calculating the hash values of the API call sequence samples, so as to eliminate duplicate samples. By comparing the hash values, the duplicate files are identified and deleted, so as to ensure the independence and diversity of the sample data set.

[0061] Step 12, normal software sample verification: the normal application program samples are submitted to VirusTotal for malware detection, and the samples marked as malicious by more than one virus reporting engine are excluded, so as to ensure the purity of the sample data set.

[0062] In a possible implementation, in step 3, the analysis environment is a sandbox environment constructed based on a dynamic binary instrumentation tool DynamoRIO, which is used to capture the kernel mode system function call sequence during sample execution.

[0063] In a possible implementation, in step 6, the large language model used is GPT-4o, and the pre-trained word embedding model is Jina-embeddings-v3, and the dimension of the output vector is set to 1024 dimensions.

[0064] In a possible implementation, in step 7, during the supervised learning training process of the hybrid neural network, a binary cross-entropy loss function is used.

[0065] According to an aspect of an embodiment of the present disclosure, a malware detection device based on a large language model is provided, and the device includes:

[0066] A data set construction and preprocessing module is configured to collect normal application program samples and malware samples running on an operating system platform extensively to form an initial data set, and then clean the data set.

[0067] A data set division module is configured to divide the cleaned data set into a training sample set and a verification sample set.

[0068] An API call sequence extraction module is configured to execute each sample in the data set in an analysis environment, capture and record the API call sequence of the sample.

[0069] a sequence preprocessing module configured to de-duplicate the API call sequences in the training sample set and the validation sample set to eliminate consecutive repeated call patterns, and then perform truncation and padding operations on the de-duplicated sequences;

[0070] an API dictionary construction module configured to statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and construct an API dictionary based on the API call types;

[0071] a text vectorization conversion module configured to construct a prompt template, generate an explanatory text description for each API in the API dictionary using a large language model, convert the text description into a vector form using a pre-trained word embedding model, and establish a mapping relationship table between the APIs and the vectors;

[0072] a model training and optimization module configured to convert the API call sequences in the training sample set into vector representations based on the mapping relationship table, input the API call sequences into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training, and optimize the parameters of the hybrid neural network using the validation sample set to obtain a final malware detection model;

[0073] a malware detection module configured to, after performing API call sequence extraction and processing on a to-be-tested sample, convert the processed sequence into a vector representation based on an API-to-vector conversion table, and input the processed sequence into the trained malware detection model to predict whether the to-be-tested sample is malware.

[0074] The description of the above apparatus has been described in detail in the description of the above method, and will not be repeated here.

[0075] Figure 3 is a block diagram of a malware detection apparatus based on a large language model according to an embodiment of the present disclosure. For example, the apparatus 1900 can be provided as a server. Referring to Figure 3 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932, for storing instructions executable by the processing component 1922, such as an application program. The application program stored in the memory 1932 can include one or more than one module each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above method.

[0076] The apparatus 1900 can also include a power supply component 1926 configured to supply power to the apparatus 1900, a wired or wireless network interface 1950 configured to connect the apparatus 1900 to a network, and an input output (I / O) interface 1958. The apparatus 1900 can operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0077] In an exemplary embodiment, a non-transitory computer readable storage medium, such as the memory 1932 including computer program instructions, is also provided, which can be executed by the processing component 1922 of the apparatus 1900 to implement the above method.

[0078] The present disclosure can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.

[0079] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or punched tape, a

[0080] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0081] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, for example, through the Internet using an Internet Service Provider. In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0082] The computer readable program instructions can also be loaded onto a computing / processing device, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computing / processing device, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computing / processing device, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0083] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can include a non-transitory computer readable storage medium that can be a computer- readable storage medium having no data storage cycles that change state. The instructions can be executed by one or more processors of a computer, to cause a series of operational steps to be performed on the computer to produce a computer-implemented process. The instructions can also cause one or more processors of a computer or other programmable data processing apparatus to

[0084] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0085] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0086] Embodiments of the present disclosure have been described above, and the description is intended to be illustrative of the embodiments and not restrictive of the disclosure. Many modifications and variations of the described embodiments are possible in light of this disclosure without departing from the scope and spirit of the described embodiments. The choice of words in this document is intended to best explain the principles of the embodiments, the practical application, or technical improvement over the existing technology, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A malware detection method based on a large language model, characterized in that: The method comprises: Step 1: Dataset construction and preprocessing: Collect a wide range of normal application samples and malware samples running on the operating system platform to form an initial dataset, and then clean the dataset; Step 2, data set division: the cleaned data set is reasonably divided into a training sample set and a validation sample set; Step 3, API call sequence extraction: Execute each sample in the dataset in the analysis environment, capture and record the API call sequence of the sample; Step 4, sequence preprocessing: De-duplicate the API call sequences in the training sample set and the validation sample set to eliminate consecutive repeated call patterns. Then, perform truncation and padding operations on the de-duplicate sequences. Step 5, API dictionary construction: Statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and construct the API dictionary based on them; Step 6: Text vectorization conversion: Build a prompt template and use a large language model to generate explanatory text descriptions for each API in the API dictionary. Then, use a pre-trained word embedding model to convert the text descriptions into vector form and establish a mapping table between each API and the vector. Step 7, model training and optimization: Based on the mapping table, the API call sequences in the training sample set are converted into vector representations and input into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training. The parameters of the hybrid neural network are optimized using the validation sample set to obtain the final malware detection model. Step 8, malware detection: After extracting and processing the API call sequence of the sample to be tested, the processed sequence is converted into a vector representation according to the API to vector conversion table and input into the trained malware detection model to predict whether the sample to be tested is malware.

2. The method according to claim 1, characterized in that In step 1, to reduce potential quality bias in the dataset, the normal application samples and malware samples are collected across multiple data sources.

3. The method according to claim 1, characterized in that In step 1, the steps to clean the dataset include: Step 11: Sample deduplication: Deduplication is performed on the samples in the dataset by calculating the hash value of the samples to eliminate duplicate samples. Step 12: Verify normal software samples: Submit normal application samples to VirusTotal for malware detection, and exclude samples marked as malicious by more than one virus detection engine.

4. The method according to claim 1, wherein In step 3, the analysis environment is a sandbox environment built based on the dynamic binary instrumentation tool DynamoRIO.

5. The method according to claim 1, wherein The large language model used in step 6 is GPT-4o, and the pre-trained word embedding model is Jina-embeddings-v3, whose output vector dimension is set to 1024 dimensions.

6. The method according to claim 1, characterized in that In step 7, the binary cross entropy loss function is used during the supervised learning training of the hybrid neural network.

7. A malware detection device based on a large language model, characterized in that: The device comprises: A dataset construction and preprocessing module is used to widely collect normal application samples and malware samples running on the operating system platform to form an initial dataset, and then clean the dataset; The data set partitioning module is used to reasonably divide the cleaned data set into a training sample set and a validation sample set; The API call sequence extraction module is used to execute each sample in the dataset in the analysis environment, capture and record the API call sequence of the sample; The sequence preprocessing module is used to deduplicate the API call sequences in the training sample set and the validation sample set to eliminate consecutive repeated call patterns. Then, the truncated and padded operations are performed on the deduplicated sequences. The API dictionary construction module is used to statistically analyze the API call sequences in the preprocessed training sample set, extract all unique API call types, and construct the API dictionary based on them; The text vectorization conversion module is used to build prompt templates and use a large language model to generate explanatory text descriptions for each API in the API dictionary. Then, a pre-trained word embedding model is used to convert the text descriptions into vector form and establish a mapping relationship table between each API and the vector; A model training and optimization module, configured to convert the API call sequences in the training sample set into vector representations based on the mapping relationship table, and input the vector representations into a hybrid neural network based on a bidirectional gated recurrent unit and a convolutional neural network for supervised learning training, and optimize the parameters of the hybrid neural network using a validation sample set to obtain a final malware detection model; The malware detection module is used to extract and process the API call sequence of the sample to be tested, convert the processed sequence into a vector representation according to the API and vector conversion table, and input it into the trained malware detection model to predict whether the sample to be tested is malware.

8. A malware detection device based on a large language model, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 6.

9. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images