基于Pulse的零日勒索软件检测：利用Transformer模型与汇编语言进行函数分类
Zero Day Ransomware Detection with Pulse: Function Classification with Transformer Models and Assembly Language
AI总结：
本研究提出基于Transformer模型与汇编语言的零日勒索软件检测框架Pulse，借助动态二进制插桩工具Peekaboo捕获真实恶意软件行为，通过消除训练与测试样本的相似功能，使模型仅靠上下文和新指令组合高精度识别新型勒索软件。
摘要：
寻找自动化AI技术以主动防御恶意软件已变得愈发关键。AI模型正确分类新型恶意软件的能力取决于其训练所用特征的质量，而特征的真实性则依赖于分析工具。Peekaboo是一款动态二进制插桩工具，可突破规避型恶意软件的防御，捕获其真实行为。Peekaboo捕获的勒索软件汇编指令遵循Zipf定律——这一在自然语言中也被观察到的规律，表明Transformer模型特别适合该二分类任务。我们提出Pulse，这是一个利用Transformer模型和汇编语言实现零日勒索软件检测的新型框架。Pulse使用Peekaboo捕获的勒索软件与良性软件数据训练，能够以高精度唯一识别真正的全新样本。Pulse消除了测试样本与训练样本之间所有相似的功能，迫使Transformer模型仅基于上下文和全新的汇编指令组合来检测恶意行为。
英文摘要：
Finding automated AI techniques to proactively defend against malware has become increasingly critical. The ability of an AI model to correctly classify novel malware is dependent on the quality of the features it is trained with and the authenticity of the features is dependent on the analysis tool. Peekaboo, a Dynamic Binary Instrumentation tool defeats evasive malware to capture its genuine behavior. The ransomware Assembly instructions captured by Peekaboo, follow Zipf's law, a principle also observed in natural languages, indicating Transformer models are particularly well suited to binary classification. We propose Pulse, a novel framework for zero day ransomware detection with Transformer models and Assembly language. Pulse, trained with the Peekaboo ransomware and benign software data, uniquely identify truly new samples with high accuracy. Pulse eliminates any familiar functionality across the test and training samples, forcing the Transformer model to detect malicious behavior based solely on context and novel Assembly instruction combinations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
