Pipeline for rewriting and validating malicious code with generative artificial intelligence

Abstract

A code sample rewrite pipeline has been created that augments training data for training malicious code detection models to learn functionality/execution behavior of malicious code and increase detection capability despite evasion techniques. The code sample rewrite pipeline ingests a set of malicious code samples. For each of the malicious code samples, the code sample rewrite pipeline prompts a language model to rewrite the malicious code sample with obfuscating transformations. The code sample rewrite pipeline evaluates output of the language model to determine whether the output is valid program code and whether it maintains functionality of the original malicious code sample. If the rewritten malicious code sample is valid and maintains functionality of the original malicious code sample, then the rewritten malicious code sample can be incorporated into training data for malicious code detection models.