AI

MalwarePT is a binary-level foundation model for malware analysis built on a ModernBERT-style encoder pretrained with masked language modeling on Windows PE code-section bytes. It transfers across malware-analysis tasks at different granularities — API call prediction, functionality classification, and malware detection under temporal drift — outperforming neural baselines and complementing feature-engineering approaches.

DeepCapa is an automated post-detection framework that identifies and maps potentially malicious capabilities in malware to the code that implements these capabilities. It proposes a novel feature engineering approach that statically extracts API-call sequences from multiple memory snapshots taken during a sample’s dynamic execution. This approach allows for more comprehensive code coverage and effectively counters anti-sandbox techniques. Deepcapa also proposes a neural network architecture to not only accurately detects capabilities but also provide interpretable detections.