ORCAGen: Orchestrating Context-Aware Malware Deception with RAG-Guided Generative AI
[Kryptografia i bezpieczeństwo] Autorzy: Shihab Ahmed, Md Sajidul Islam Sajid, Teryl Taylor i 2 więcej
Malware defenses often remove or isolate suspicious programs as quickly as possible. While effective for containment, this approach can also waste an opportunity to observe attacker behavior and deploy targeted countermeasures. ORCAGen takes a different approach: it uses GenAI to build malware-specific deception playbooks offline, validates them before deployment, and enforces only the verified logic at runtime. ORCAGen combines Retrieval-Augmented Generation (RAG) with structured prompt engineering to generate both proof-of-concept (PoC) malware and corresponding deception orchestration code. A curated knowledge base (KB) of malware procedures and active defense strategies grounds the generation process, helping the LLM produce threat-specific and executable deception logic rather than generic or hallucinated outputs. The generated PoC malware provides a safe and reproducible way to te…
- Kategoria arxiv
- cs.CR
- Kategoria
- Kryptografia i bezpieczeństwo