Dynamic analysis methods effectively identify shelled, wrapped, or obfuscated
malware, thereby preventing them from invading computers. As a significant
representation of dynamic malware behavior, the API (Application Programming
Interface) sequence, comprised of consecutive API calls, has progressively
become the dominant feature of dynamic analysis methods. Though there have been
numerous deep learning models for malware detection based on API sequences, the
quality of API call representations produced by those models is limited. These
models cannot generate representations for unknown API calls, which weakens
both the detection performance and the generalization. Further, the concept
drift phenomenon of API calls is prominent. To tackle these issues, we
introduce a prompt engineering-assisted malware dynamic analysis using GPT-4.
In this method, GPT-4 is employed to create explanatory text for each API call
within the API sequence. Afterward, the pre-trained language model BERT is used
to obtain the representation of the text, from which we derive the
representation of the API sequence. Theoretically, this proposed method is
capable of generating representations for all API calls, excluding the
necessity for dataset training during the generation process. Utilizing the
representation, a CNN-based detection model is designed to extract the feature.
We adopt five benchmark datasets to validate the performance of the proposed
model. The experimental results reveal that the proposed detection algorithm
performs better than the state-of-the-art method (TextCNN). Specifically, in
cross-database experiments and few-shot learning experiments, the proposed
model achieves excellent detection performance and almost a 100% recall rate
for malware, verifying its superior generalization performance. The code is
available at: github.com/yan-scnu/Prompted_Dynamic_Detection.

通过使用 GPT-4 进行提示工程辅助的恶意软件动态分析方法，在 API 序列中为每个 API 调用创建说明性文本，利用预训练的语言模型 BERT 获取文本的表示，从而获得 API 序列的表示。通过这种方法，本文提出能够生成所有 API 调用的表示，无需在生成过程中进行数据集训练。利用该表示，设计了一种基于 CNN 的检测模型，并通过五个基准数据集验证了该模型的性能优于最先进的方法 (TextCNN)。在跨数据库实验和少样本学习实验中，该模型表现出良好的检测性能，并几乎达到 100％的恶意软件召回率，证实了其卓越的泛化性能。