Abstract
Adversarial attacks on machine learning-based malware detection models could enable attackers to craft evasive malware variants that remain functional while bypassing detection. However, existing methods primarily focus on feature-space adversarial attacks, lacking effective mapping from feature-space to code-space (i.e. the modifications of source code of malware to implement the adversarial attacks), which limits its practical application. To address this issue, this paper proposes an large language model (LLM) enhanced code-space adversarial attack method against the dynamic malware detection models, achieving end-to-end generation of executable and source code-level adversarial samples. First, we apply a feature-space adversarial attack algorithm to perturb the feature vectors and pinpoint the changes of dynamic behaviors (e.g. API calls). Second, we propose a prompt mechanism guided by the dynamic behavior changes and code generation hints to automatically modify the source code of malware samples by leveraging an LLM. Experiments on five types of typical malware demonstrate that the proposed method can effectively modify the source code of malware based on the adversarial perturbations, and consistently outperforms existing approaches in terms of evasion capability and functionality retention.