AI Insight
This study introduces Trident, a malware detection system that combines traditional static feature analysis with large language model (LLM) processing of dynamic behavioral reports from sandbox environments. The researchers demonstrate that LLMs can effectively analyze semi-structured sandbox behavior reports to generate detection rules that are more resilient to concept drift than conventional static-feature methods. Trident uses a majority voting approach across three components: a decision tree model on static features, LLM-generated behavioral detection rules, and direct LLM analysis of sandbox reports, achieving superior performance compared to standard static-feature methods alone.
Why it matters
This approach addresses a critical challenge in cybersecurity where malware rapidly evolves to evade detection systems that rely solely on static characteristics. By incorporating behavioral analysis through LLMs, the system maintains effectiveness over time without requiring frequent retraining, potentially reducing the operational burden on security teams while improving detection rates.
Understand the Science
⚠️ Preprint – Noch nicht peer-reviewed
Dieser Artikel wurde noch nicht von unabhängigen Experten begutachtet. Die Ergebnisse sind vorläufig und sollten mit Vorsicht interpretiert werden.
-cross
Abstract: Traditionally, machine learning methods for PE malware detection have relied on static features like byte histograms, string information, and PE header contents. One barrier to incorporating dynamic analysis features has been the semi-structured nature of sandbox behavior reports. We show that, using the latest generation of large language models with reasoning, it is possible to efficiently process these behavior reports and utilize them as part of a malware detection pipeline. Specifically, we leverage LLMs to generate behavior-based malware detection rules based on a small training set of labeled malware. We find that these detection rules, derived from behavioral features, are much more robust to concept drift than standard static-feature methods, while maintaining practical false positive rates. Finally, we introduce Trident, a system which combines a classic decision tree model over static features, our behavior-based detection rules, and direct LLM analysis of sandbox reports through majority voting. Trident outperforms standard methods using static features, outperforms behavior-based rules alone, and is as resilient to concept drift as active learning methods without requiring retraining.
Source: Trident: Improving Malware Detection with LLMs and Behavioral Features