APT Attack Organization Identification Profiling Based on Big Language Models

In this paper, we introduce a novel method for detecting APT (Advanced Persistent Threat) malware and generating organizational profiles by integrating deep learning with a large-scale language model. We address the challenges of gradient explosion and vanishing in traditional grayscale image feature extraction by employing an RGB image-based feature representation, which captures richer texture information and enables deeper mining of APT malware characteristics. Our enhanced convolutional neural network model incorporates the Self-Attention mechanism and Spatial Pyramid Pooling (SPP-net) to effectively handle varying image input sizes, significantly improving model adaptability and accuracy. Experimental results demonstrate that our method not only enhances the detection accuracy of APT malware and its variants but also enables precise tracing of the organization behind the APT attack and identification of specific attack methodologies. The outputs from the deep learning model are further processed by a large-scale language model, which provides detailed analysis and generates comprehensive organizational profiles. Visual analysis of APT threat features underscores the effectiveness of our approach in both malware variant detection and traceability. This method empowers security experts with enhanced detection capabilities and detailed organizational insights, facilitating a more informed and timely response to APT attacks. The findings highlight the importance of integrating deep learning and large-scale language models in advancing cybersecurity, particularly in the context of timely APT detection and defense.