Capturing the behavioral signature of polymorphic malware using generative AI
In one implementation, a device captures behavioral snapshots of a piece of executable code. The device generates a prompt based on the behavioral snapshots. The device generates a malware signature for the piece of executable code in part by inputting the prompt into a generative model. The device provides the malware signature for use to detect malware.
1 . A method, comprising:
capturing, by a device, behavioral snapshots of a piece of executable code that includes a particular type of polymorphic malware;
generating, by the device, a prompt based on the behavioral snapshots that comprises a request to determine a difference or a correlation between the behavioral snapshots;
generating, by the device, a malware signature for the piece of executable code that models behavioral patterns of the particular type of polymorphic malware over time in part by inputting the prompt into a generative model; and
providing, by the device, the malware signature for use to detect the particular type of polymorphic malware.
2 . The method as in claim 1 , wherein the device captures the behavioral snapshots by executing the piece of executable code in a sandbox environment.
3 . The method as in claim 1 , wherein the behavioral snapshots comprise one or more of: memory access patterns, network activities, or file descriptors.
4 . The method as in claim 1 , wherein the device uses an artificial intelligence model to capture the behavioral snapshots of the piece of executable code over time.
5 . The method as in claim 1 , wherein the device captures the behavioral snapshots based on a determination that the piece of executable code exhibited a behavioral anomaly.
6 . The method as in claim 1 , wherein the generative model is a language model.
7 . The method as in claim 6 , wherein generating the malware signature for the piece of executable code further comprises:
using, by the device, an output of the language model as input to a generative adversarial network (GAN) to produce labels for the malware signature.
8 . The method as in claim 1 , wherein the device generates the prompt in part based on input from a user interface.
9 . The method as in claim 1 , wherein the device provides the malware signature for use to detect malware by storing the malware signature in a vector database.
10 . The method as in claim 1 , wherein an anti-malware endpoint agent or a network traffic analyzer uses the malware signature to detect malware.
11 . An apparatus, comprising:
one or more network interfaces;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process when executed configured to:
capture behavioral snapshots of a piece of executable code that includes a particular type of polymorphic malware;
generate a prompt based on the behavioral snapshots that comprises a request to determine a difference or a correlation between the behavioral snapshots;
generate a malware signature for the piece of executable code that models behavioral patterns of the particular type of polymorphic malware over time in part by inputting the prompt into a generative model; and
provide the malware signature for use to detect the particular type of polymorphic malware.
12 . The apparatus as in claim 11 , wherein the apparatus captures the behavioral snapshots by executing the piece of executable code in a sandbox environment.
13 . The apparatus as in claim 11 , wherein the behavioral snapshots comprise one or more of: memory access patterns, network activities, or file descriptors.
14 . The apparatus as in claim 11 , wherein the apparatus uses an artificial intelligence model to capture the behavioral snapshots of the piece of executable code over time.
15 . The apparatus as in claim 11 , wherein the apparatus captures the behavioral snapshots based on a determination that the piece of executable code exhibited a behavioral anomaly.
16 . The apparatus as in claim 11 , wherein the generative model is a language model.
17 . The apparatus as in claim 16 , wherein the apparatus generates the malware signature for the piece of executable code further by:
using an output of the language model as input to a generative adversarial network (GAN) to produce labels for the malware signature.
18 . The apparatus as in claim 11 , wherein the apparatus generates the prompt in part based on input from a user interface.
19 . The apparatus as in claim 11 , wherein the apparatus provides the malware signature for use to detect malware by storing the malware signature in a vector database.
20 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
capturing, by the device, behavioral snapshots of a piece of executable code that includes a particular type of polymorphic malware;
generating, by the device, a prompt based on the behavioral snapshots that comprises a request to determine a difference or a correlation between the behavioral snapshots;
generating, by the device, a malware signature for the piece of executable code that models behavioral patterns of the particular type of polymorphic malware over time in part by inputting the prompt into a generative model; and
providing, by the device, the malware signature for use to detect the particular type of polymorphic malware.