Attention Is All You Need for Semantics Detection:A Novel Transformer on Neural…
summary
A neural-symbolic Transformer called KU (Kur Ida) is built to infer unknown Windows APIs from static binaries by combining a symbolic engine that extracts argument values and an attention model with precision-wise semantic encoding. The pretrained model (about 60,226 GPU hours) is tiny and runs in ~30s per sample; on 122,200 collected upx/packed samples it finds >400 binaries with hidden behaviors across 18 sensitive classes (startup persistence, privilege escalation, anti-sandbox) and flags unknown APIs like InternetOpenA and registry operations. Tools and code are released on GitHub.
AI-written summary · about
chapters (20)
- 0:00AI for malware semantics
- 1:09Obfuscated malware challenges
- 3:17Rule-based API limits
- 5:48Neural symbolic Transformer
- 9:42API arguments from binaries
- 14:41Training on APT binaries
- 17:35Inferring hidden API calls
- 19:00Obfuscated API code detection
- 20:24Malware evasion tricks
- 21:52YARA vs AI detection
- 22:35Startup folder abuse case
- 24:01Hybrid malware analysis
- 25:49Shellcode symbolic execution
- 28:45Cobalt Strike shellcode case
- 30:07Unpacking commercial packers
- 33:39VMProtect detection
- 35:31Real-time packed analysis
- 36:59Binary analysis limits
- 38:45Open-sourcing tools
- 39:29Q&A
related talks
26mRethinking the Transformer: Toward Native Multimodal Architectures
36mNeural Networks
55mDive into the Future: .NET and AI!
49mBen Hall & Barbara Fusinska
24mRevealing the Unseen: Visualizing Attention in Transformer Models
01h 10mNeurosymbolic Program Synthesis: Bridging Perception and Reasoning in Real-World(…)
48mKeynote – Sameer Singh
26mSemantic Kernel: Teaching AI to Not Just Repeat, But Complete!