{"id":"https://openalex.org/W4416178197","doi":"https://doi.org/10.1109/secdev66745.2025.00027","title":"Obfusc8: LLM-Augmented PowerShell Obfuscation","display_name":"Obfusc8: LLM-Augmented PowerShell Obfuscation","publication_year":2025,"publication_date":"2025-10-14","ids":{"openalex":"https://openalex.org/W4416178197","doi":"https://doi.org/10.1109/secdev66745.2025.00027"},"language":null,"primary_location":{"id":"doi:10.1109/secdev66745.2025.00027","is_oa":false,"landing_page_url":"https://doi.org/10.1109/secdev66745.2025.00027","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Secure Development Conference (SecDev)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120648056","display_name":"Kwangyun Keum","orcid":null},"institutions":[{"id":"https://openalex.org/I4210101778","display_name":"Samsung (United States)","ror":"https://ror.org/01bfbvm65","country_code":"US","type":"company","lineage":["https://openalex.org/I2250650973","https://openalex.org/I4210101778"]},{"id":"https://openalex.org/I4210133173","display_name":"Research!America (United States)","ror":"https://ror.org/044pgyv50","country_code":"US","type":"company","lineage":["https://openalex.org/I4210133173"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kwangyun Keum","raw_affiliation_strings":["Samsung Research America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Samsung Research America","institution_ids":["https://openalex.org/I4210101778","https://openalex.org/I4210133173"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Dheeraj Kumar","orcid":null},"institutions":[{"id":"https://openalex.org/I4210101778","display_name":"Samsung (United States)","ror":"https://ror.org/01bfbvm65","country_code":"US","type":"company","lineage":["https://openalex.org/I2250650973","https://openalex.org/I4210101778"]},{"id":"https://openalex.org/I4210133173","display_name":"Research!America (United States)","ror":"https://ror.org/044pgyv50","country_code":"US","type":"company","lineage":["https://openalex.org/I4210133173"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dheeraj Kumar","raw_affiliation_strings":["Samsung Research America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Samsung Research America","institution_ids":["https://openalex.org/I4210101778","https://openalex.org/I4210133173"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120546570","display_name":"Bogdan Barchuk","orcid":null},"institutions":[{"id":"https://openalex.org/I4210101778","display_name":"Samsung (United States)","ror":"https://ror.org/01bfbvm65","country_code":"US","type":"company","lineage":["https://openalex.org/I2250650973","https://openalex.org/I4210101778"]},{"id":"https://openalex.org/I4210133173","display_name":"Research!America (United States)","ror":"https://ror.org/044pgyv50","country_code":"US","type":"company","lineage":["https://openalex.org/I4210133173"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bogdan Barchuk","raw_affiliation_strings":["Samsung Research America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Samsung Research America","institution_ids":["https://openalex.org/I4210101778","https://openalex.org/I4210133173"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115513564","display_name":"Sai Chand Boyapati","orcid":null},"institutions":[{"id":"https://openalex.org/I4210101778","display_name":"Samsung (United States)","ror":"https://ror.org/01bfbvm65","country_code":"US","type":"company","lineage":["https://openalex.org/I2250650973","https://openalex.org/I4210101778"]},{"id":"https://openalex.org/I4210133173","display_name":"Research!America (United States)","ror":"https://ror.org/044pgyv50","country_code":"US","type":"company","lineage":["https://openalex.org/I4210133173"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sai Chand Boyapati","raw_affiliation_strings":["Samsung Research America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Samsung Research America","institution_ids":["https://openalex.org/I4210101778","https://openalex.org/I4210133173"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120349078","display_name":"Rohit Deopura","orcid":null},"institutions":[{"id":"https://openalex.org/I4210101778","display_name":"Samsung (United States)","ror":"https://ror.org/01bfbvm65","country_code":"US","type":"company","lineage":["https://openalex.org/I2250650973","https://openalex.org/I4210101778"]},{"id":"https://openalex.org/I4210133173","display_name":"Research!America (United States)","ror":"https://ror.org/044pgyv50","country_code":"US","type":"company","lineage":["https://openalex.org/I4210133173"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Rohit Deopura","raw_affiliation_strings":["Samsung Research America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Samsung Research America","institution_ids":["https://openalex.org/I4210101778","https://openalex.org/I4210133173"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5021423602","display_name":"Amir Rahmati","orcid":"https://orcid.org/0000-0001-7361-1898"},"institutions":[{"id":"https://openalex.org/I59553526","display_name":"Stony Brook University","ror":"https://ror.org/05qghxh33","country_code":"US","type":"education","lineage":["https://openalex.org/I59553526"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Amir Rahmati","raw_affiliation_strings":["Stony Brook University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Stony Brook University","institution_ids":["https://openalex.org/I59553526"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"156","last_page":"168"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9186000227928162,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9186000227928162,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.04259999841451645,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.007699999958276749,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.8385000228881836},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.8119999766349792},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.7236999869346619},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.715499997138977},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.49390000104904175},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.49309998750686646},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.45809999108314514},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4226999878883362},{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.4025000035762787}],"concepts":[{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.8385000228881836},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8119999766349792},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8116999864578247},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.7236999869346619},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.715499997138977},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6287000179290771},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.49390000104904175},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.49309998750686646},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.45809999108314514},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4226999878883362},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.4025000035762787},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.40130001306533813},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.39649999141693115},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.3959999978542328},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.3781999945640564},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.3560999929904938},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.3499000072479248},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.33559998869895935},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3165000081062317},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2921999990940094},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.2702000141143799},{"id":"https://openalex.org/C20136886","wikidata":"https://www.wikidata.org/wiki/Q749647","display_name":"Interoperability","level":2,"score":0.26510000228881836},{"id":"https://openalex.org/C40842320","wikidata":"https://www.wikidata.org/wiki/Q19423","display_name":"Buffer overflow","level":2,"score":0.25600001215934753},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.25440001487731934},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2535000145435333},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.25279998779296875},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.2517000138759613}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/secdev66745.2025.00027","is_oa":false,"landing_page_url":"https://doi.org/10.1109/secdev66745.2025.00027","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Secure Development Conference (SecDev)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Cyber-attacks":[0],"have":[1,37],"evolved":[2],"dramatically":[3],"over":[4],"the":[5,202,237,276,284,307,315],"past":[6],"decade,":[7],"becoming":[8],"more":[9],"targeted":[10],"and":[11,21,31,80,88,105,117,129,132,191,227,253,282],"sophisticated.":[12],"Attackers":[13],"now":[14],"employ":[15],"various":[16],"techniques,":[17,184],"including":[18,185],"phishing,":[19],"ransomware,":[20],"Remote":[22],"Command":[23],"Execution":[24],"(RCE),":[25],"to":[26,48,51,64,83,92,175,223,243,262,306,310],"exploit":[27,77],"vulnerabilities":[28],"in":[29,231,314],"systems":[30,46],"compromise":[32],"user":[33],"accounts.":[34],"PowerShell":[35,161,211],"scripts":[36,71,162],"become":[38],"a":[39,78,157,170,179,296,304],"popular":[40],"tool":[41,82],"among":[42],"attackers":[43],"for":[44,99,159,287,298],"compromising":[45],"due":[47],"their":[49],"ability":[50],"execute":[52,84],"commands":[53],"directly":[54],"from":[55],"memory,":[56],"enabling":[57],"fileless":[58,100],"malware":[59,269],"attacks":[60],"that":[61,216],"are":[62,72,119],"challenging":[63],"detect":[65],"with":[66,259],"traditional":[67,183],"antivirus":[68,134,234,241,280],"solutions.":[69],"These":[70],"especially":[73],"dangerous":[74],"as":[75,126,194,196,295,303],"they":[76],"trusted":[79],"powerful":[81],"commands,":[85],"evade":[86,224],"detection,":[87],"gain":[89],"extensive":[90,148],"access":[91],"system":[93],"resources,":[94],"making":[95],"them":[96],"highly":[97],"effective":[98],"attacks,":[101],"remote":[102],"code":[103,198],"execution,":[104],"lateral":[106],"movement":[107],"across":[108],"networks.":[109],"To":[110],"defend":[111],"against":[112],"these":[113],"scripts,":[114],"both":[115],"enterprises":[116],"individuals":[118],"increasingly":[120],"relying":[121],"on":[122],"defensive":[123],"mechanisms,":[124],"such":[125,140],"Endpoint":[127],"Detection":[128],"Response":[130],"(EDR)":[131],"built-in":[133],"solutions":[135,242,281],"like":[136],"Windows":[137],"Defender.":[138],"Circumventing":[139],"defenses":[141],"often":[142],"involves":[143],"sophisticated":[144],"obfuscation":[145,252],"techniques":[146],"requiring":[147],"domain":[149],"knowledge.":[150],"In":[151],"this":[152],"paper,":[153],"we":[154],"introduce":[155],"Obfusc8,":[156],"framework":[158,249],"obfuscating":[160,207],"using":[163],"Large":[164],"Language":[165],"Models":[166],"(LLMs).":[167],"Obfusc8":[168,205,217,248,274],"utilizes":[169],"carefully":[171],"crafted":[172],"iterative":[173,251],"process":[174],"obfuscate":[176,220],"PowerShell,":[177],"employing":[178],"diverse":[180],"set":[181],"of":[182,204,239,271,278,317],"object":[186],"insertion,":[187],"case":[188],"alternation,":[189],"fragmentation,":[190],"noise":[192],"injection,":[193],"well":[195],"LLM-based":[197],"rewriting.":[199],"We":[200],"evaluated":[201],"effectiveness":[203],"by":[206],"25":[208],"widely":[209,232],"recognized":[210],"scripts.":[212],"Our":[213,290],"results":[214],"show":[215],"can":[218],"successfully":[219],"malicious":[221],"payloads":[222,265],"signaturebased,":[225],"heuristic,":[226],"ML-based":[228],"detection":[229,312],"mechanisms":[230,313],"used":[233],"software,":[235],"demonstrating":[236],"susceptibility":[238],"builtin":[240],"bypass":[244],"LLM-powered":[245],"techniques.":[246],"The":[247],"leverages":[250],"functionality":[254],"verification,":[255],"allowing":[256],"even":[257],"users":[258,300],"minimal":[260],"expertise":[261],"transform":[263],"basic":[264],"into":[266],"fully":[267],"functional":[268],"capable":[270],"bypassing":[272],"detection.":[273],"highlights":[275],"limitations":[277],"current":[279],"underscores":[283],"urgent":[285],"need":[286],"stronger":[288],"defenses.":[289],"findings":[291],"serve":[292],"not":[293],"only":[294],"warning":[297],"individual":[299],"but":[301],"also":[302],"call":[305],"security":[308],"community":[309],"improve":[311],"face":[316],"rapidly":[318],"evolving":[319],"AI-driven":[320],"threats.":[321]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-11-13T00:00:00"}