Inteligência artificial generativa em cibersegurança
Carregando...
Tipo
TCC
Data de publicação
2024-12-09
Periódico
Citações (Scopus)
Autores
Campos, Julio Wesley da Mota
Orientador
Gazzola, Murilo Gleyson
Título da Revista
ISSN da Revista
Título de Volume
Membros da banca
Programa
Resumo
Este estudo avalia o uso de Large Language Models (LLMs) na área de cibersegurança, com foco em seu potencial para análise de códigos maliciosos e nas vulnerabilidades que podem levar ao uso indevido dessas ferramentas. Com o avanço tecnológico proporcionado pelos LLMs, há um debate crescente sobre suas aplicações: enquanto podem atuar como aliados poderosos na identificação e mitigação de ameaças, também apresentam riscos quando manipulados para fins maliciosos. Para explorar essa questão, foram realizados testes práticos com modelos gratuitos, incluindo ChatGPT, Gemini e Mistral. Amostras de malware foram coletadas na plataforma VirusShare, descompiladas por meio do software Ghidra e analisadas com o apoio dos modelos. Durante os experimentos, técnicas de engenharia de prompt foram utilizadas para avaliar as respostas dos LLMs diante de solicitações sutis ou diretas. Os resultados revelaram que, quando questionados de forma neutra, os modelos podem gerar códigos com potencial para atividades maliciosas. Já na análise de códigos descompilados, os LLMs demonstraram comportamentos distintos: o ChatGPT apresentou maior cobertura na identificação de funções maliciosas, o Gemini mostrou-se eficiente na detecção de mecanismos de proteção, enquanto o Mistral destacou-se na identificação de funções ligadas à persistência e comunicação de rede. O estudo conclui que, embora os LLMs ofereçam grande potencial como ferramentas de apoio à cibersegurança, suas vulnerabilidades exigem a implementação de controles rigorosos para evitar usos indevidos, garantindo sua aplicação de forma ética e segura no combate às ameaças digitais.
This study evaluates the use of Large Language Models (LLMs) in cybersecurity, focusing on their potential for malicious code analysis and the vulnerabilities that may lead to their misuse. With the technological advances brought by LLMs, there is an increasing debate regarding their dual application: while they can serve as powerful allies in identifying and mitigating threats, they also pose risks when manipulated for malicious purposes. To investigate this issue, practical tests were conducted using free models, including ChatGPT, Gemini, and Mistral. Malware samples were collected from the VirusShare platform, decompiled using the Ghidra software, and analyzed with the support of these models. During the experiments, prompt engineering techniques were applied to evaluate the responses of LLMs to both subtle and direct requests. The results revealed that when prompted neutrally, the models can generate code with potential for malicious activities. In the analysis of decompiled code, the LLMs displayed distinct behaviors: ChatGPT exhibited broader coverage in identifying malicious functions, Gemini excelled at detecting protection mechanisms, and Mistral proved effective in identifying functions related to persistence and network communication. The study concludes that while LLMs offer significant potential as tools to support cybersecurity, their vulnerabilities necessitate the implementation of robust controls to prevent misuse, ensuring their ethical and secure application in combating digital threats.
This study evaluates the use of Large Language Models (LLMs) in cybersecurity, focusing on their potential for malicious code analysis and the vulnerabilities that may lead to their misuse. With the technological advances brought by LLMs, there is an increasing debate regarding their dual application: while they can serve as powerful allies in identifying and mitigating threats, they also pose risks when manipulated for malicious purposes. To investigate this issue, practical tests were conducted using free models, including ChatGPT, Gemini, and Mistral. Malware samples were collected from the VirusShare platform, decompiled using the Ghidra software, and analyzed with the support of these models. During the experiments, prompt engineering techniques were applied to evaluate the responses of LLMs to both subtle and direct requests. The results revealed that when prompted neutrally, the models can generate code with potential for malicious activities. In the analysis of decompiled code, the LLMs displayed distinct behaviors: ChatGPT exhibited broader coverage in identifying malicious functions, Gemini excelled at detecting protection mechanisms, and Mistral proved effective in identifying functions related to persistence and network communication. The study concludes that while LLMs offer significant potential as tools to support cybersecurity, their vulnerabilities necessitate the implementation of robust controls to prevent misuse, ensuring their ethical and secure application in combating digital threats.
Descrição
Indicado para publicação
Palavras-chave
cibersegurança , large language models , análise de malware , segurança da informação , cybersecurity , large language models , malware analysis , information security