Malware Analysis

Follow this topic Ask about this topic

Malware analysis examines software artifacts and runtime behavior to detect threats, identify families or authors, and explain how attacks work. Approaches range from static inspection of bytes, imports, code, and call graphs to sandbox-based analysis of API calls and system events, often combined with machine learning, graph or sequence models, and image-based features. Recent work also applies language models to reverse engineering and threat-intelligence extraction, while using evidence checks and human review to improve reliability. A central challenge is that malware changes over time and can manipulate data or evade detectors, so systems must balance accuracy with robustness, interpretability, and analysis cost.

Latest papers

58 papers3 papers in the last four weeks, level with the four weeks before. 0.0% of all new papers.

MARS: Malware Analysis with Rule-Based Scoring of LLM Claims
Oct 7, 2026Hyeongjun ChoiMalware Classification LLMs for Cybersecurity
78ResearchLab, 8, Yangpyeong-ro 25-gil, Yeongdeungpo-gu, Seoul, 07207, Republic of Korea
From Sandbox to Enforcement: Confidence-Qualified Threat Intelligence for Critical Infrastructure
Oct 5, 2026Nikolaos Kekatos, Mihaela Curcă, Georgios Koutidis +5Cyber Threat Intelligence Cybersecurity
Clone Systems, Cyprus · Romanian National Cyber Security Directorate (DNSC), Romania · Bolton Technologies, Cyprus +1
A Structured State Space Sequence Model for Multi-Class Classification of Malware
Oct 1, 2026Emmanuela Andam, Rana Shaaban, Emanuel Grant +1Cybersecurity Malware Classification
Artificial Intelligence Research (AIR) Center · School of Electrical Engineering and Computer Science, College of Engineering & Mines University of North Dakota, Grand Forks, ND 58201, USA
ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers
Sep 17, 2026Hyeongjun Choi, Wonyoung Jung, Haehoon Seo +1Adversarial Attacks on LLMs LLM Security
78ResearchLab Seoul, South Korea
SCRIPTIOC-BENCH: A Benchmark for Recognizing Actionable Threat Intelligence from Script-Based Malware using LLMs
Sep 5, 2026Hanna Kim, Jian Cui, Minkyoo Song +4Malware Analysis LLMs for Cybersecurity
KAIST · University of Illinois Urbana-Champaign · ETRI
Cost-Aware Hierarchical Multi-Agent Ransomware Detection and Family Attribution under Analysis Budgets
Sep 4, 2026Mubashar Iqbal, Asifullah Khan, Hifsa Asif +3Malware Detection Malware Analysis
Pattern Recognition Lab, DCIS, Pakistan Institute of Engineering and Applied Sciences (PIEAS), Nilore, Islamabad, Pakistan · Deep Learning Lab, Center for Mathematical Sciences, PIEAS, Nilore, Islamabad, Pakistan · Interdisciplinary Research Center for Smart Mobility and Logistics, King Fahd University of Petroleum & Minerals, Dhahran 31261, Saudi Arabia +2
EGAMA-RC: Risk-Calibrated Evidence-Gated Adaptive Malware Analysis for Robust and Interpretable Memory-Forensic Triage
Aug 24, 2026Isaac Kofi NtiMalware Analysis Malware Detection
School of Information Technology, University of Cincinnati, Ohio, USA.
ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection
Aug 4, 2026Md Faisal Ahmed, Zarin Tasnim Biash, Abu Raihan Shakil +4Android Malware Detection Malware Classification
Department of Computer Science and Engineering Brac University Dhaka, Bangladesh
Self-Supervised Representations for Binary Program Clustering: From Empirical Study to Retrieval-Augmented Learning
Aug 3, 2026Martin Mocko, Daniela ChudáRepresentation Learning Self-Supervised Learning
Faculty of Information Technology, Brno University of Technology, Brno, Czech Republic · Kempelen Institute of Intelligent Technologies (KInIT), Bratislava, Slovakia · Faculty of Electrical Engineering and Information Technology, Slovak University of Technology, Bratislava, Slovakia
Behavioral Grammar: Detecting Adaptive Malware via Tiny Language Model Priors and Second-Order Temporal Analysis
Aug 1, 2026Zihan LuoUnsupervised Anomaly Detection Malware Analysis
Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis
Jul 22, 2026Adel ElZemity, Shujun Li, Budi AriefMulti-Agent LLM Systems Small Language Models
University of Kent, Canterbury, United Kingdom
ThreatVisionAI: A Hybrid CNN-ViT Framework for Image-Based Malware Classification
Jul 4, 2026Allyson Taylor, Prashanth BusiReddyGariHybrid CNN-Transformer Architectures Malware Classification
Department of Mathematics & Computer Science University of North Carolina Pembroke
LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection
Jul 3, 2026Hang Gao, Xiaoyu Chen, Baoquan Cui +4Heterogeneous GNNs Hierarchical Representation Learning
Institute of Software, Chinese Academy of Sciences · University of Chinese Academy of Sciences
Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes
Jul 1, 2026Derek Everett, Edward Raff, James HoltMalware Classification Malware Analysis
Amazon, Baltimore, USA · CrowdStrike, Austin, USA
AI-Generated PowerShell Malware: An Experimental Framework and Dataset
Jun 29, 2026Luciano Pianese, Vittorio Orbinato, Pietro Liguori +1LLMs for Cybersecurity Malware Analysis
Department of Electrical Engineering and Information Technology (DIETI), Universit`a degli Studi di Napoli Federico II, Naples, Italy · Gran Sasso Science Institute, L’Aquila, Italy
A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution
Jun 29, 2026Jithin S., Roshin Sleeba C., Anvin Mariya P. B. +4Multi-Task Learning Malware Classification
Department of Computer Applications, Cochin University of Science and Technology, India · Department of Electrical, Computer and Biomedical Engineering, University of Pavia, Italy
Multi-View Decompilation for LLM-Based Malware Classification
Jun 18, 2026Bercan Turkmen, Vyas RainaSoftware Reverse Engineering LLM Prompting
Independent Researcher · SPARK
MASCOT-Android: A Curated Dataset and Automated Collection Pipeline for Android Malware Source Code Specimens
Jun 15, 2026Bojing Li, Duo Zhong, Prajna Bhandary +4Android Malware Detection Malware Analysis
University of Maryland, Baltimore County Baltimore, Maryland, USA
ViPER: Vision-based Packing-Aware Encoder for Robust Malware Detection
Jun 11, 2026Fatima Qaiser, Bisma Tahir, Muhammad Abid Mughal +1Malware Classification Malware Analysis
Department of Computer & Information Sciences, Pakistan Institute of Engineering & Applied Sciences (PIEAS), Islamabad, Pakistan
MOLOT System Card: Malicious Operational Logic Observation Transformer
Jun 5, 2026Daniil Lopatkin, Maksim Mitrofanov, Stanislav Rakovsky +1Static Code Analysis Malware Classification
Data Science & ML Dept. Positive Technologies False Positive Community
AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification
Jun 5, 2026Parthajit Borah, Sakshi Singh, D. K. Bhattacharyya +1Malware Classification Malware Analysis
School of Cyber Security and Digital Forensics, National Forensic Sciences University,Guwahati. · Department of Computer Science and Engineering, Tezpur University, Tezpur, 784028, Assam, India. · Computer Science, College of Engineering and Applied Science, University of Colorado,Colorado Springs, CO 80933-7150, Colorado, USA.
MalTree: Tracing Malware Evolution from Embeddings at Scale
Jun 4, 2026Akash Amalan, Georgios Smaragdakis, Tom J. VieringPhylogenetic Inference Malware Analysis
Delft University of Technology, Delft, The Netherlands.
AI Agents Enable Adaptive Computer Worms
Jun 2, 2026Jonas Guan, Tom Blanchard, Hanna Foerster +3Cybersecurity Malware Analysis
University of Toronto · University of Cambridge · 4ServiceNow
High-Precision APT Malware Attribution with Out-of-Scope Resilience
Jun 2, 2026Peter Williams, Adam Sobey, Erisa KarafiliSelective Prediction Malware Classification
University of Southampton, Southampton, UK · The Alan Turing Institute, London, UK
A Hybrid Approach For Malware Classification Using Secondary Features Fusion
Jun 2, 2026Raja Khurram Shahzad, Muhammad Mustaqeem, Haroon ElahiMalware Classification Malware Analysis
Department of Computer and System Science, Mid Sweden University, Östersund Campus, Jämtland, Sweden. · Department of Engineering, Arbisoft (Pvt.) Ltd., Lahore, Punjab, Pakistan. · Department of Computing Science and Engineering, Chalmers University of Technology, Gothenburg, Västerbotten, Sweden.
Large Byte Model: Teaching Language Models About Compiled Code
Jun 1, 2026Florian Störtz, Catalin-Andrei Stan, Alexandru Dinu +4Malware Classification Byte-Level Language Model
CrowdStrike · CrowdStrike U.K. · CrowdStrike Romania +1
MAECO-Lite: Modular Ontology for Dynamic Malware Analysis
May 29, 2026Zekeri Adams, Peter Švec, Ján Kľuka +4Malware Analysis
Department of Applied Informatics, Comenius University in Bratislava, Mlynská dolina, 842 48 Bratislava, Slovakia · Institute of Computer Science and Mathematics, Faculty of Electrical Engineering and Information Technology, Slovak University of Technology, Ilkoviˇcova 3, Bratislava, Slovakia
Automatically Attacking Software Reverse Engineering AI Agents
May 28, 2026Brian Crawford, Justin Phillips, Patrick McClureSoftware Engineering Adversarial Prompt Generation
Naval Postgraduate School, Monterey, CA, United States
Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem
May 27, 2026Luca Beurer-Kellner, Aleksei Kudrinskii, Marco Milanta +3AI Agent Security Malware Analysis
1Snyk
Building an Adversarial Malware Dataset by Family and Type: Generation, Evasion, and Poisoning Evaluation
May 25, 2026David Košťál, Martin JurečekAdversarial Attacks Malware Classification
Department of Information Security, Faculty of Information Technology, Czech Technical University in Prague

Oct 7, 2026J/K move · Enter open · S save

MARS: Malware Analysis with Rule-Based Scoring of LLM Claims

Hyeongjun Choi

78ResearchLab, 8, Yangpyeong-ro 25-gil, Yeongdeungpo-gu, Seoul, 07207, Republic of Korea

Malware Classification LLMs for Cybersecurity Malware Analysis LLM Evaluation

Open paper AskPDF arXiv

Large language models can triage malware through direct verdicts or behavioral claims scored by an external policy. We present MARS, a malware triage framework, and compare direct classification with single-pass claim scoring using the same evidence collector and identical static evidence bundles for each model. The evaluation covers 1,195 PE and ELF binaries grouped into 1,001 near-duplicate clusters and six language models, with deterministic rules providing a baseline. Direct classification is more accurate for all six models. On samples with usable outputs from both paths, its accuracy advantage ranges from 3.7 to 20.9 percentage points, with all 95% cluster-bootstrap confidence intervals for the differences above zero. It also achieves higher malicious alert recall in ten of twelve platform and model combinations. Claim mediation provides no consistent reduction in performance variation across models. Separate subset studies find more consistent alert decisions for direct classification and a larger recall loss for the claim path when predefined indicator fields are removed. In a family identification probe, claims yield higher accuracy than verdict labels but lower accuracy than evidence text. Retained claims expose the inputs to verdict computation and permit policy revision without another model call. We reproduce archived verdicts exactly and apply a revised policy to the same records, including outputs from two additional models withdrawn by their provider. Under the evaluated claim taxonomy and additive policy, these results favor direct classification when only a verdict is required, while demonstrating that retained claims support explicit policy inspection and revision.