Binary malware summarization aims to automatically generate human-readable descriptions of malware behaviors from executable files, facilitating tasks like malware cracking and detection. Previous methods based on Large Language Models (LLMs) have shown great promise. However, they still face significant issues, including poor usability, inaccurate explanations, and incomplete summaries, primarily due to the obscure pseudocode structure and the lack of malware training summaries. Further, calling relationships between functions, which involve the rich interactions within a binary malware, remain largely underexplored. To this end, we propose MALSIGHT, a novel code summarization framework that can iteratively generate descriptions of binary malware by exploring malicious source code and benign pseudocode. Specifically, we construct the first malware summaries, MalS and MalP, using an LLM and manually refine this dataset with human effort. At the training stage, we tune our proposed MalT5, a novel LLM-based code model, on the MalS dataset and a benign pseudocode dataset. Then, at the test stage, we iteratively feed the pseudocode functions into MalT5 to obtain the summary. Such a procedure facilitates the understanding of pseudocode structure and captures the intricate interactions between functions, thereby benefiting the usability, accuracy, and completeness of summaries. Additionally, we propose a novel evaluation benchmark, BLEURT-sum, to measure the quality of summaries. Experiments on three datasets show the effectiveness of the proposed MALSIGHT. Notably, our proposed MalT5, with only 0.77B parameters, delivers comparable performance to much larger ChatGPT3.5.

翻译：二进制恶意软件摘要旨在从可执行文件中自动生成人类可读的恶意软件行为描述，以辅助恶意软件分析与检测等任务。基于大语言模型（LLMs）的现有方法已展现出巨大潜力，但仍面临可用性差、解释不准确及摘要不完整等显著问题，这主要源于伪代码结构模糊及缺乏恶意软件训练摘要。此外，涉及二进制恶意软件内部丰富交互的函数间调用关系在很大程度上仍未得到充分探索。为此，我们提出MALSIGHT，一种新颖的代码摘要框架，能够通过探索恶意源代码与良性伪代码来迭代生成二进制恶意软件描述。具体而言，我们利用LLM构建了首个恶意软件摘要数据集MalS与MalP，并通过人工精修完善该数据集。在训练阶段，我们在MalS数据集和一个良性伪代码数据集上微调了我们提出的新型基于LLM的代码模型MalT5。随后，在测试阶段，我们迭代地将伪代码函数输入MalT5以获取摘要。该流程有助于理解伪代码结构并捕获函数间复杂的交互关系，从而提升摘要的可用性、准确性和完整性。此外，我们提出了一种新颖的评估基准BLEURT-sum，用于衡量摘要质量。在三个数据集上的实验验证了所提MALSIGHT的有效性。值得注意的是，我们提出的MalT5仅包含0.77B参数，却能取得与规模大得多的ChatGPT3.5相媲美的性能。