一句话：将思维链融入马尔可夫过程驱动 LLM 生成对抗性恶意软件，在 12 款杀毒引擎上平均逃逸率达 89.92%。
本文系统研究了大型语言模型（LLM）生成对抗性恶意软件以规避静态检测的能力。此前 LLM 的滥用风险已在钓鱼攻击与虚假信息传播中被证实，但其在恶意软件对抗生成方面的进展与潜在影响仍缺乏实证。作者将思维链（chain of thought）融入马尔可夫过程，设计了基于提示的状态转移函数与奖励机制，引导 LLM 迭代改写恶意软件样本以逃避检测。评估在包含 2000 余个真实恶意软件样本的数据集上进行，面向 VirusTotal 上 12 款主流商业杀毒引擎，测得平均逃逸率为 89.92%。结果表明，即使缺乏专业技术背景、仅具备基本自然语言能力的人也能生成可绕过静态检测的恶意软件，凸显了当前网络空间防御与检测体系在对抗性恶意软件应对上的脆弱性。
Large Language Models (LLMs) have achieved notable progress in fields including natural language processing, cyber threat detection, and automated penetration testing, increasingly being applied in practical settings. However, the rapid advancement of these models has also led to their potential misuse, posing new challenges to cyberspace security. Security incidents have already been reported in areas such as phishing attacks and disinformation campaigns. Nevertheless, the progress and potential impact of LLMs in generating adversarial malware remain underexplored. This study systematically investigates the evasion capability of adversarial malware generated by LLMs. By integrating chain of thought into a Markov process and designing prompt based state transition functions and reward mechanisms, this research evaluates the effectiveness and efficiency against mainstream static detection methods on a dataset comprising over 2,000 real-world malware samples. Experimental results demonstrate an average evasion rate of 89.92% across 12 commercial antivirus engines on VirusTotal. The findings reveal that individuals with minimal technical expertise and basic natural language skills can generate malware that evades static detection, which underscores potential vulnerabilities in current cyberspace defense and detection systems regarding adversarial malware countermeasures.
DOI 原文 ·
@inproceedings{paperbot9613,
title = {From Large Language Models to Adversarial Malware: How far are we},
author = {Shuai He and Hao Yan and Wenke Li and Sheng Hong and Xiaowei Guo and Xiaofan Liu and Cai Fu},
booktitle = {ISSTA},
year = {2025},
doi = {10.1145/3713081.3732928}
}