对对抗性代码混淆和加密下大型语言模型进行IoC恢复的基准测试
Benchmarking Large Language Models for IoC Recovery under Adversarial Code Obfuscation and Encryption
AI总结：
本文提出一个系统性基准测试，评估LLM在对抗性代码转换下恢复隐藏的IoC能力，发现加密技术显著降低检测性能，揭示LLM在代码分析中的局限性及改进方向。
摘要：
软件混淆和加密对程序理解和安全分析构成持续挑战，尤其是当攻击者在源代码中隐藏指标迹象（IoCs）如IP地址时。尽管大型语言模型（LLMs）最近在代码推理和转换方面取得了显著进展，但其对对抗性隐藏技术的抗性仍待探索。本文引入了一个系统性基准测试，用于评估LLM在对抗性代码转换下恢复隐藏IoC的能力。我们构建了一个包含336个程序的数据集，通过12层混淆和加密转换（包括XOR和AES-256）逐步生成，以模拟真实威胁场景。一个自动评估框架标准化了LLM的查询和响应，使在不同模型上进行可重复、大规模测试成为可能。我们的结果揭示出二元对立：尽管LLM在轻量级转换如变量重命名和Base64编码中表现优异，但基于加密的隐藏技术严重降低检测性能。这些发现确立了加密作为LLM驱动代码分析的关键前沿，并突显了当前的局限性及改进自动化威胁情报的途径。
英文摘要：
Software obfuscation and encryption present persistent challenges for program comprehension and security analysis, particularly when adversaries conceal Indicators of Compromise (IoCs) such as IP addresses within source code. While Large Language Models (LLMs) have recently demonstrated remarkable progress in code reasoning and transformation, their resilience against adversarial concealment techniques remains largely uncharted. This paper introduces a systematic benchmark for secret detection under adversarial code transformations, designed to evaluate the capacity of LLMs to recover IoCs embedded in obfuscated and encrypted JavaScript programs. We construct a dataset of 336 programs, progressively transformed through 12 levels of obfuscation and cryptographic concealment (including XOR and AES-256), to emulate realistic threat scenarios. An automated evaluation framework standardizes LLM queries and responses, enabling reproducible, large-scale testing across diverse models. Our results reveal a dichotomy: while LLMs exhibit high success against lightweight transformations such as variable renaming and Base64 encoding, encryption-based concealment severely degrades detection performance. These findings establish encryption as a critical frontier for LLM-driven code analysis and highlight both current limitations and avenues for advancing automated threat intelligence.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
