Dynamic Malware Analysis using LLMs (Internship) King Abdullah University of Science and Technology (KAUST)

Overview

While static methods such as disassembly and code review remain crucial, many malware samples use packers and obfuscation techniques that necessitate memory captures and dynamic analysis [Dynamic, 2012]. Similarly, hooking system and API calls at lower levels provides a more comprehensive view of a program’s true behavior. 

It enables analysts to capture transient execution stages in a multi-layered malware. Large learning models (LLM) such Llama 3, GPT-4, and Gemini can interpret assembly instructions, reconstruct probable software behaviors, and produce intuitive summaries of code functionality.

Key Facts of the Dynamic Malware Analysis using LLMs (Internship) project from King Abdullah University of Science and Technology (KAUST)

However, these LLMs require domain-specific adaptation, typically known as fine-tuning, to capture the nuances of metamorphic transformations, which often incorporate custom encryption or code permutation routines. In this line of research, they collaborate with Prof. Ali Hassan to advance the state of the art of malware analysis by designing an integrated solution that combines dynamic instrumentation, multi-run analysis, and LLM-driven annotations for effective deobfuscation and analysis of a malware.