A.I. Assisted Malware Capabilities Capturing
Andrei Mogage · Procedia Computer Science · 2024
Malware analysis is a demanding task regarding techniques, time and creativity. On multiple occasions, however, security researchers are interested in checking if the analyzed threat possesses specific capabilities, disregarding the overall picture. In this paper, we combine our malware expertise with the results of a Large Language Model, in order to expand the knowledge and creativity in generating specific rules that encode these capabilities. The rules, along with malicious applications, are then used as inputs for a malware analysis framework created by us, in order to determine if the application has those specific capabilities. The findings show promising results, sustained by synthetic and real-life experiments.