Large Language Model-Enhanced Malware Dynamic Detection Method

With the rapid advancement of network technology, incidents of network attacks are increasingly frequent, and malware has become a commonly used tool in such attacks. Dynamic analysis plays a crucial role for security professionals in understanding and assessing malware, allowing for the capture of dynamic behaviors within a sandbox environment. However, determining the maliciousness of these behaviors often requires substantial expert knowledge, making the process both time-consuming and challenging. To address this, we propose an automated technique for determining sandbox analysis reports as malicious or benign. Our approach combines dynamic features extracted from sandbox reports with a large language model. By fine-tuning a model based on Llama3, we achieve accurate determination between malicious and benign samples, reaching a precision of 96.82