LLM Code Descriptions for Low-False-Positive Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional code review processes for identifying security vulnerabilities in source code are laborious and require extensive human expertise, leading to inefficiencies and increased computing resource waste due to undetected malware and vulnerabilities.
Innovation Solution
Employing generative artificial intelligence, specifically large language models (LLMs) to generate natural language descriptions of code for enhanced threat analysis and malware detection, utilizing Neural Machine Translation (NMT) to reduce false positives and improve malware detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional code review processes are used to identify security vulnerabilities, then human expertise can detect malicious code, but the process becomes laborious and increases computing resource waste
Solution Approach 1:
The patent introduces an intermediary system comprising neural machine translation models and natural language processing components that act as a mediator between the source code and human analysts. This intermediary automatically generates explanations of code functionality, filtering and preprocessing information before human review, thereby maintaining detection accuracy while reducing the labor burden and time required for manual code analysis
Solution Approach 2:
The patent replaces the mechanical process of manual code inspection with an automated intelligent system using neural machine translation and natural language generation. The system automatically analyzes code, generates explanations, and identifies potential malware, substituting the manual mechanical review process with an automated computational system that improves both efficiency and scalability
2Measurement precision
If manual code analysis is performed to understand code instructions, then security vulnerabilities can be identified, but it requires extensive human expertise and time
Solution Approach 1:
The patent applies preliminary action by automatically generating explanations of code functionality and identifying potential security issues before human analysts begin their review. The system pre-processes the code, creates natural language descriptions of what the code does, and highlights suspicious patterns, so that human reviewers can focus their expertise on critical areas rather than reading every line of code from scratch
Solution Approach 2:
The natural language processing system serves as an intermediary that translates complex code instructions into human-understandable explanations, bridging the gap between machine code and human comprehension. This intermediary provides precise vulnerability detection through automated analysis while reducing the time humans need to spend on detailed code inspection
3Reliability
If conventional malware detection methods are used, then malicious code can be identified, but false positives occur and reduce detection accuracy
Solution Approach 1:
The patent implements feedback mechanisms where the neural machine translation system continuously learns from analysis results and adjusts its explanations accordingly. The system provides feedback loops that refine its understanding of code patterns, allowing it to distinguish between benign and malicious code more accurately over time, thereby reducing false positives while maintaining high detection reliability
Solution Approach 2:
The patent uses a composite approach combining multiple technologies: neural machine translation, natural language processing, and traditional malware detection methods. This composite system integrates different analytical approaches to cross-validate findings, reducing false positives by requiring multiple indicators of maliciousness before flagging code, thereby improving overall detection accuracy
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A system and method of using generative AI to generate natural language descriptions of code for enhanced threat analysis and malware detection. The method includes determining that a file comprises source code for causing malicious activity. The method includes generating, by a processing device and using one or more large language models (LLMs), natural language (NL) descriptions of the source code responsive to determining whether the file comprises the source code to cause the malicious activity. The method includes providing the NL descriptions of the source code to a classification model trained to generate a first set of maliciousness scores each indicating whether source codes are associated with one or more types of malicious activity. The method includes generating, using the classification model, a maliciousness score for the source code indicating that the source code is associated with the one or more types of malicious activity.