Behavioral Grammar: Tiny Language Model Detects Adaptive Malware
A new study recently appeared on arXiv (2608.00745) that introduces Behavioral Grammar, a groundbreaking framework for detecting host runtime activities by treating them like a structured language. It uses a streamlined causal Transformer called TinyGPT, which has 0.88M parameters. This setup transforms system events into an 8-token structure that includes details such as event type, process, and user information. By adopting a self-supervised strategy, it learns the usual behavior patterns and calculates anomaly scores based on negative log-likelihood statistics to control false positives. Additionally, the model improves its function with prototype learning and second-order temporal analysis, making it a promising lightweight solution for cybersecurity and endpoint detection.
Key facts
- The paper is titled 'Behavioral Grammar: Detecting Adaptive Malware via Tiny Language Model Priors and Second-Order Temporal Analysis'.
- It is available on arXiv with identifier 2608.00745v1.
- The detection architecture uses a 0.88M-parameter causal Transformer called TinyGPT.
- Each system event is represented as an 8-token sequence.
- The model learns normal behavior in a self-supervised manner.
- Anomaly scores are based on per-slot negative log-likelihood (NLL) statistics.
- The approach provides a mathematically bounded false-positive rate.
- Prototype learning is used for known-attack attribution.
Entities
Institutions
- arXiv