Scholarlink

<p>In High-Performance Computing (HPC) environments, a comprehensive understanding of cybersecurity threats and their underlying attack strategies is essential. However, current research predominantly focuses on maliciousness determination, typically emphasizing the code’s operational behaviors rather than the attack strategies employed. The advancements in multimedia computing, particularly Large Language Models (LLMs), have paved the way for innovative solutions to the aforementioned bottleneck. This work proposes MalGTA (Guided Malware Tactical Analysis), an LLM-based system that automates ATT&amp;CK (Adversarial Tactics, Techniques, and Common Knowledge)-aligned malware tactical analysis through Cuckoo Sandbox-driven dynamic profiling. Specifically, we construct a multi-source knowledge base integrated with Retrieval-Augmented Generation (RAG), which mitigates hallucinations in LLMs through context-sensitive threat intelligence retrieval. In addition, we propose a query optimization strategy to address challenges related to input information overload and attention dispersion in LLMs, enabling context-aware data refinement from Cuckoo reports. Finally, this study conducts dynamic analysis on classical VirusShare and Advanced Persistent Threat (APT) samples and constructs an evaluation dataset based on the authoritative malware analysis platform HybridAnalysis. Experimental results show the effectiveness of the method. </p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Malgta: large language model-based guided malware tactical analysis

  • 期刊论文

  • 发表日期：

    2025年6月19日

查看全文
  • Wenjie Guo,
  • Jingfeng Xue,
  • Zeyang Liu,
  • Weijie Han,
  • Jingjing Hu

摘要

In High-Performance Computing (HPC) environments, a comprehensive understanding of cybersecurity threats and their underlying attack strategies is essential. However, current research predominantly focuses on maliciousness determination, typically emphasizing the code’s operational behaviors rather than the attack strategies employed. The advancements in multimedia computing, particularly Large Language Models (LLMs), have paved the way for innovative solutions to the aforementioned bottleneck. This work proposes MalGTA (Guided Malware Tactical Analysis), an LLM-based system that automates ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge)-aligned malware tactical analysis through Cuckoo Sandbox-driven dynamic profiling. Specifically, we construct a multi-source knowledge base integrated with Retrieval-Augmented Generation (RAG), which mitigates hallucinations in LLMs through context-sensitive threat intelligence retrieval. In addition, we propose a query optimization strategy to address challenges related to input information overload and attention dispersion in LLMs, enabling context-aware data refinement from Cuckoo reports. Finally, this study conducts dynamic analysis on classical VirusShare and Advanced Persistent Threat (APT) samples and constructs an evaluation dataset based on the authoritative malware analysis platform HybridAnalysis. Experimental results show the effectiveness of the method.