LLM Code Descriptions for Faster, Lower-False-Positive Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity methods for detecting malicious code in source code are laborious, require human expertise in multiple programming languages, and suffer from high false positive rates, leading to inefficient resource utilization and security vulnerabilities.
Innovation Solution
Employing generative artificial intelligence, specifically large language models (LLMs) to generate natural language descriptions of code, which are then analyzed by classification models to determine maliciousness scores, reducing false positives and enhancing threat analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human experts manually analyze source code for malware detection, then detection accuracy can be maintained, but the process becomes laborious and time-consuming
Solution Approach 1:
The patent introduces an intermediary system comprising code explanation generation models and natural language processing components that mediate between the source code and human analysts. These intermediaries automatically generate explanations of code functionality, allowing analysts to quickly understand malicious behavior without manually examining every line of code, thus maintaining high detection accuracy while significantly reducing analysis time.
Solution Approach 2:
The system enables self-service by automatically generating code explanations and threat assessments without requiring deep human expertise for every analysis. The automated generation of natural language descriptions of code functionality allows the system to serve itself in the initial analysis phase, freeing human experts to focus only on complex cases that require human judgment.
2Reliability
If human experts manually review code to reduce false positives, then detection reliability improves, but resource utilization becomes inefficient
Solution Approach 1:
The patent segments the code review process into automated explanation generation and human verification stages. The system divides the analysis workload by automatically generating code explanations for routine cases, reserving human expert resources only for cases requiring nuanced judgment. This segmentation maintains high detection reliability while dramatically improving overall resource utilization efficiency.
3Adaptability or versatility
If comprehensive code analysis is performed to detect all malicious activities, then security coverage is improved, but the complexity of the detection system increases
Solution Approach 1:
The patent employs natural language processing models as intermediaries that translate complex code analysis into human-understandable explanations. These intermediary models handle the complexity of comprehensive code analysis internally, presenting simplified threat assessments to users. This approach maintains broad security coverage while keeping the user-facing system complexity manageable.
4Productivity
If automated code analysis is implemented to improve productivity, then resource utilization improves, but false positive rates increase
Solution Approach 1:
The system implements self-service through automated generation of code explanations that include contextual information about code functionality and potential malicious behavior. This automated explanation generation provides sufficient context for most cases, reducing false positives while maintaining high productivity. The system serves itself by generating its own analytical insights without requiring constant human intervention.
Data Source
AI summary
A system and method of using generative AI to generate natural language descriptions of code for enhanced threat analysis and malware detection. The method includes determining that a file comprises source code for causing malicious activity. The method includes generating, by a processing device and using one or more large language models (LLMs), natural language (NL) descriptions of the source code responsive to determining whether the file comprises the source code to cause the malicious activity. The method includes providing the NL descriptions of the source code to a classification model trained to generate a first set of maliciousness scores each indicating whether source codes are associated with one or more types of malicious activity. The method includes generating, using the classification model, a maliciousness score for the source code indicating that the source code is associated with the one or more types of malicious activity.