标题： 探索大型语言模型用于安卓恶意软件的语义分析和分类 显示英文标题

标题： Exploring Large Language Models for Semantic Analysis and Categorization of Android Malware

摘要： 恶意软件分析是一个复杂的流程，涉及对恶意软件的功能、来源和潜在影响进行检查和评估。 这个艰难的流程通常包括分解软件以了解其组件、感染途径、传播机制和负载。 多年来，对恶意软件的深度逆向工程变得越来越繁琐，主要是由于现代恶意代码库的快速演变和复杂性。 本质上，分析人员的任务是在零日恶意软件的复杂性中找到隐藏的针尖，同时在严格的时间限制下完成。 因此，在本文中，我们探讨利用大型语言模型（LLMs）进行语义恶意软件分析，以加快已知和新型样本的分析。 基于GPT-4o-mini模型，\msp 旨在通过分层摘要链和策略性提示工程来增强Android平台的恶意软件分析。 此外，\msp 执行恶意软件分类，区分潜在恶意软件和良性应用程序，从而在恶意软件逆向工程过程中节省时间。 尽管未针对Android恶意软件分析进行微调，但我们证明，通过优化和先进的提示工程，\msp 可以达到高达77%的分类准确率，同时在功能、类别和包级别提供高度稳健的摘要。 此外，利用从包级别到功能级别的摘要反向追踪，使我们能够精确定位导致恶意行为的代码片段。 显示英文摘要

摘要： Malware analysis is a complex process of examining and evaluating malicious software's functionality, origin, and potential impact. This arduous process typically involves dissecting the software to understand its components, infection vector, propagation mechanism, and payload. Over the years, deep reverse engineering of malware has become increasingly tedious, mainly due to modern malicious codebases' fast evolution and sophistication. Essentially, analysts are tasked with identifying the elusive needle in the haystack within the complexities of zero-day malware, all while under tight time constraints. Thus, in this paper, we explore leveraging Large Language Models (LLMs) for semantic malware analysis to expedite the analysis of known and novel samples. Built on GPT-4o-mini model, \msp is designed to augment malware analysis for Android through a hierarchical-tiered summarization chain and strategic prompt engineering. Additionally, \msp performs malware categorization, distinguishing potential malware from benign applications, thereby saving time during the malware reverse engineering process. Despite not being fine-tuned for Android malware analysis, we demonstrate that through optimized and advanced prompt engineering \msp can achieve up to 77% classification accuracy while providing highly robust summaries at functional, class, and package levels. In addition, leveraging the backward tracing of the summaries from package to function levels allowed us to pinpoint the precise code snippets responsible for malicious behavior.