Attention Is All You Need for Semantics Detection: A Novel Transformer on Neural-Symbolic Approach

Attention Is All You Need for Semantics Detection: A Novel Transformer on Neural-Symbolic Approach

Speakers: Mars (Research Manager), Shao (Team Leader), Ian (Dedicated Researcher) from TS1 P3 Research Team

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=-PdQtTn6mf8

Overview

In an era defined by the escalating sophistication of cyber threats, the prevalence of highly obfuscated and packed malware presents a formidable challenge for blue teams worldwide. This talk, presented by the TS1 P3 research team from Taiwan, introduces a groundbreaking approach to automate the semantic detection of malicious binaries. Titled "Attention Is All You Need for Semantics Detection: A Novel Transformer on Neural-Symbolic Approach," the presentation delves into the application of an attention mechanism within a neural-symbolic transformer model to overcome the limitations of traditional malware analysis.

The core objective of this research is to leverage advancements in Artificial Intelligence (AI) to address the scalability issues faced by human malware analysts. By modeling and automating the intricate process of deciphering obfuscated functions and identifying unknown API calls, the team aims to provide blue teams with a powerful tool for timely and precise analysis of large volumes of malware samples. The proposed system, referred to as Cuda, represents a significant step forward in applying AI to practical cybersecurity challenges, particularly in detecting stealthy and evasive threats like hidden Windows shellcode.

This talk is critical for security professionals, malware analysts, and AI researchers interested in the intersection of machine learning and cybersecurity. It highlights the inherent difficulties in static and dynamic analysis of modern malware and offers a novel, AI-driven solution that mimics human expert reasoning. By demonstrating how AI can effectively infer malicious intent from complex code structures, the TS1 P3 team provides a blueprint for future defensive strategies against advanced persistent threats.

Background

▶ Watch: Introduction to malware detection challenges and team (0:00)

The landscape of cybersecurity is continuously evolving, with attackers employing increasingly sophisticated techniques to evade detection. A primary challenge for blue teams lies in the sheer volume and complexity of obfuscated malware samples and the widespread use of commercial packers. These techniques make it incredibly difficult to analyze and identify specific malicious behaviors, often masking critical indicators of compromise. Furthermore, Windows shellcode is frequently hidden, designed to execute dynamically, often making detection too late by the time its malicious actions are observed.

Traditionally, experienced malware analysts rely on their accumulated knowledge and tools like IDA Pro to decipher obfuscated functions. They meticulously trace data reference relationships, identify flags associated with known functions (e.g., a flag belonging to CreateFile), and determine variable types (e.g., V13 as a file handle) to verify against invalid values before proceeding to subsequent operations like GetFileSize. This process of reasoning and reverse engineering program code through continuous data reference relationships was systematically studied in a 2022 paper, underscoring its importance. However, the critical limitation of this approach is its scalability; the number of human experts is finite, and they cannot cope with the massive influx of new malware samples effectively.

Recognizing this bottleneck, the TS1 P3 team had previously presented a related method at Black Hat USA 2022. Their earlier approach utilized taint analysis as a foundation for performing semantic analysis of APIs and incorporated various expert rules to identify unknown API sequences. While innovative, this method also faced significant limitations. It necessitated human experts to write a vast number of rules, a task that proved overwhelming and challenging to cover comprehensively due to human constraints and the potential for oversight. This experience highlighted the need for an automated solution that could deduce unknown symbols from data relationships without extensive manual rule creation. For example, while an API with seven parameters might intuitively point to CreateFile, an API with four parameters where multiple options exist requires judgment based on parameter values and data types, such as an integer first parameter and a flag with a common value like 105 or 180 for RedrawWindow. The core problem remained: how to automate this expert reasoning to identify unknown API calls based on contextual data.

Key Findings

▶ Watch: How human experts deduce unknown API symbols (4:10)

The central contribution of this research is the development of a novel neural-symbolic transformer model, dubbed Cuda, designed to automate the semantic detection of obfuscated and packed malware. The key findings revolve around its ability to transcend the limitations of previous rule-based systems by mimicking the reasoning process of human experts through AI.

The primary finding is that by combining taint analysis with an advanced AI model, it is possible to effectively model and automate the human understanding process of identifying behavioral intentions associated with unique attack methods or API usage combinations. This enables the system to automatically infer attack behaviors that resemble those observed during the model training stage, leveraging similar data reference relationships encountered in future analyses.

Specifically, the Cuda model utilizes an attention engine and word embedding techniques to capture real-world API usage patterns within obfuscated binaries. This allows it to identify unknown APIs by considering function argument positions and tokenized symbols required for pre-operations. After processing through the trained model, it can calculate and obtain possible API names, significantly reducing the manual effort required for analysis. The system has been applied to three specialized tools for blue teams, demonstrating its practical utility and proving helpful in real-world applications. This marks a significant advancement in bridging the gap between human expert knowledge and scalable, automated malware analysis.

Technical Deep Dive

▶ Watch: Presenting Cuda, the trained inference decompiler agent (5:50)

The technical foundation of the TS1 P3 team's approach rests on automating the intricate reasoning process employed by human malware analysts. The core idea is to use AI to understand the behavioral intentions linked to unique attack methods or specific API usage combinations, which are often obscured in heavily obfuscated code. This automation is achieved through their proposed neural-symbolic transformer model, Cuda.

The process begins by recognizing how human experts deduce unknown symbols from data relationships. For instance, if a Windows API call has seven parameters, an analyst might intuitively identify it as CreateFile because it's the only common Windows API with that specific parameter count. However, more complex scenarios arise when multiple APIs share the same parameter count. In such cases, human judgment relies on the parameter values and their data types. For example, if an unknown API has four parameters, and the first is an integer while the fourth is a flag with a common value like 105 or 180, an expert can deduce it's likely the RedrawWindow API, as it exhibits this specific usage pattern. The Cuda model aims to replicate this sophisticated decision-making process.

The technical architecture involves several key components:

1. Symbolic Engine for API Sequence Extraction:

The first step is to extract meaningful API sequences from obfuscated binaries. This is achieved using a symbolic engine that processes decompiled results, often obtained from tools like IDA Pro. When the engine encounters an unknown call, it employs a clever technique: it replaces the return value of such unknown code with a magic number. This magic number acts as a placeholder and a marker.

The crucial insight here is how relationships between API calls are identified. If any subsequent API call uses this magic number as an argument value, the symbolic engine can then infer and capture a data reference relationship between the preceding unknown API and the following API. This allows the system to build a contextual understanding of how unknown functions interact within the program flow, even when their direct names are obscured. This process effectively translates the continuous data reference relationships that human experts trace into a machine-readable format.

1. Taint Analysis as a Foundation:

Building upon their previous work at Black Hat USA 2022, the Cuda model utilizes taint analysis as a foundational element. Taint analysis helps track the flow of data within a program, identifying how information from untrusted sources (or in this case, the output of unknown functions) propagates and influences subsequent operations. This is crucial for understanding the semantic implications of unknown API calls and their arguments.

1. Neural-Symbolic Transformer with Attention Engine and Word Embedding:

The extracted API sequences and identified data relationships, enriched by taint analysis, are then fed into the core of the system: the Cuda neural-symbolic transformer.

• Neural-Symbolic Approach: This combines the strengths of symbolic reasoning (explicit rules, logical inference, like the magic number tracking) with neural networks (pattern recognition, learning from data). This hybrid approach is ideal for tasks that require both structured understanding and the ability to generalize from complex, noisy data.
• Attention Engine: The transformer architecture, famously using "attention is all you need," allows the model to selectively focus on the most relevant parts of the input sequence. In the context of API calls, the attention mechanism helps the model understand which parameters, flag values, or preceding API calls are most indicative of a particular semantic meaning or malicious behavior. It can weigh the importance of different pieces of context when making a prediction.
• Word Embedding: To capture the "real-world API usage" effectively, the system employs word embedding techniques. This involves representing each API call, parameter type, and flag value as a dense vector in a high-dimensional space. APIs with similar functionalities or common usage patterns will have vector representations that are closer to each other. This allows the model to understand the semantic similarity and relationships between different API calls, even if their names are unknown or obfuscated.

Once the pre-processed data (function argument positions, tokenized symbols, data types, and relationships) passes through the trained Cuda model, it performs inference. The model calculates and outputs the most probable API names or semantic classifications for the previously unknown calls. This output provides blue teams with actionable intelligence, allowing them to quickly understand the true intent behind obfuscated code segments. By automating this complex analysis, Cuda allows for timely and precise analysis on a much larger scale than human experts could ever achieve alone.

Demo / Proof of Concept

▶ Watch: Automating human malware analysis using AI models (7:50)

While the talk did not feature a live, step-by-step demonstration of the Cuda model in action, the speakers affirmed its practical utility and real-world application. They stated that the output from the trained Cuda model is directly applied to "three tools designed specifically for blue team's practical analysis need and is having proven to be helpful for the real world applications."

This suggests that the core proof of concept lies in the successful integration of the Cuda model's capabilities into existing or newly developed analysis tools used by their research team or potentially their clients. The implication is that the model is actively being used to assist in the identification of unknown APIs and the semantic analysis of obfuscated malware, demonstrating its effectiveness in a practical operational environment rather than merely a theoretical exercise. The success of these deployments serves as the primary validation of the approach.

Defensive Implications

▶ Watch: Creating a symbolic engine to extract API sequences (10:15)

The development of the Cuda neural-symbolic transformer offers significant defensive implications for blue teams grappling with advanced malware. The primary benefit is the ability to automate and scale malware analysis, a task that traditionally heavily relies on scarce human expertise.

1. Accelerated Analysis of Obfuscated Malware: Cuda drastically reduces the time and effort required to analyze highly obfuscated samples and those protected by commercial packers. By automatically inferring unknown API calls and their semantic intent, it allows blue teams to quickly understand the true functionality of malicious code, bypassing the obfuscation layers designed to hinder analysis.
2. Early Detection of Hidden Shellcode: Windows shellcode, often hidden and executed dynamically, is notoriously difficult to detect proactively. Cuda's ability to analyze static code and infer potential dynamic behaviors based on API usage patterns can lead to earlier detection of such threats, preventing malicious execution before it's "too late."
3. Augmentation of Human Expertise: Rather than replacing human analysts, Cuda acts as a powerful force multiplier. It automates the tedious, repetitive aspects of reverse engineering, allowing human experts to focus on higher-level threat intelligence, incident response, and developing countermeasures for novel attack techniques. It essentially scales the "accumulated knowledge" of experienced analysts.
4. Proactive Threat Intelligence: By identifying new or evolving API usage combinations that signify malicious intent, Cuda can contribute to a more proactive threat intelligence posture. It can help identify emerging attack patterns and develop signatures or detection rules before widespread compromise.
5. Enhanced Tooling for Blue Teams: The integration of Cuda's capabilities into specialized tools provides blue teams with more intelligent and effective instruments for static and dynamic analysis, incident response, and forensic investigations. These tools can leverage the AI model to provide semantic context where traditional decompilers or disassemblers only show raw code.

In essence, Cuda empowers defenders to keep pace with the ever-increasing volume and sophistication of malware, transforming a labor-intensive and expert-dependent process into a more scalable and efficient operation.

Key Takeaways

• The Challenge of Obfuscation: The vast volume of highly obfuscated malware and commercial packers makes manual semantic analysis by human experts unsustainable and prone to oversight.
• Limitations of Prior AI Approaches: Earlier AI methods, such as rule-based API identification, required extensive human effort to write and maintain rules, failing to scale effectively.
• Neural-Symbolic Transformer (Cuda): The TS1 P3 team introduced Cuda, a novel AI model that combines symbolic reasoning (like magic number tracking) with neural networks (attention mechanisms, word embeddings) to automate semantic detection.
• Automating Expert Reasoning: Cuda mimics how human experts deduce unknown API symbols by analyzing parameter counts, data types, and flag values, translating this into an automated, scalable process.
• Practical Application: The model utilizes taint analysis and a symbolic engine (using "magic numbers" for unknown call return values) to capture data reference relationships and infer API names, proving effective in real-world blue team tools.
• Enhanced Defensive Capabilities: Cuda provides blue teams with a powerful tool to accelerate malware analysis, proactively detect hidden shellcode, and scale expert knowledge, significantly improving their ability to defend against advanced threats.

About the Speaker(s)

The presentation was delivered by the TS1 P3 research team from Taiwan.

Mars is the research manager of the TS1 P3 team. He is an experienced speaker, having presented at numerous cybersecurity conferences over 14 times around the world, demonstrating his deep expertise and commitment to sharing cutting-edge research.

Shao is the team leader of the research team. Like Mars, he has also presented at many cybersecurity conferences, indicating his leadership in driving innovative security research.

Ian is a dedicated researcher within the TS1 P3 team, contributing to the technical depth and development of the presented work.