Rei Yamagishi

Large language models (LLMs) are becoming more advanced and widespread and have shown their applicability to various domains, including cybersecurity. Static malware analysis is one of the most important tasks in cybersecurity; however, it is time-consuming and requires a high level of expertise. Therefore, we conducted a demonstration experiment focusing on whether an LLM can be used to support static analysis. First, we evaluated the ability of the LLM to explain malware functionality. The results showed that the LLM can generate descriptions that cover functions with an accuracy of up to 90.9\%. In addition, we asked six static analysts to perform a pseudo static analysis task using LLM explanations to verify that the LLM can be used in practice. Through subsequent questionnaires and interviews with the participants, we also demonstrated the practical applicability of LLMs. Lastly, we summarized the problems and required functions when using an LLM as static analysis support, as well as recommendations for future research opportunities.

In the security field, information dissemination and user cooperation are important, and icons are sometimes used to help users understand information. In this study, we conducted a survey on the current status of icons used in the security field and a questionnaire survey to understand the current status of icons used in the security field. In the survey, 1,146 icons in the security field were extracted from websites and documents of public institutions in Japan and labeled. These icons were analyzed to show that the current situation in which several different icons are assigned to a single term and the lack of consistency may hinder understanding. In addition, a questionnaire survey of 434 participants asked about the meanings of the icons extracted in the current survey and showed that the answers varied and that a common understanding may not have been formed. Furthermore, we showed that assigning the same meaning to different icons leads to confusion, regardless of the user’s knowledge or self-perception. On the basis of these findings, we recommend the creation of guidelines for defining security terms and icons to reduce the cognitive load on users. We believe that the results of this study will contribute to the future use of security icons and to the education and dissemination of information about them.

Phishing via email has been spreading not only to individuals but also to companies, and various studies have been conducted on it. In addition, the use of chat has been increasing, and phishing via chat is assumed to be occurring, but the risk and susceptibility to phishing via chat have not been clarified. In this study, we conducted a questionnaire survey of 304 participants. In the survey, we divided the participants into two groups, designed similar phishing scenarios using email and chat, and conducted a role play susceptibility study. The results of the study indicated that the susceptibility of chat was as high as or higher than that of email, suggesting that phishing via chat is risky. On the basis of the results, we also summarized methods for reducing the risk of phishing in chat and recommendations for future research.