Malware Analysis

Follow this topic Ask about this topic

Momentum

2 papers in the last four weeks, with none the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 51

All topics

MARS: Malware Analysis with Rule-Based Scoring of LLM Claims
Oct 7, 2026Hyeongjun ChoiMalware Classification LLMs for Cybersecurity
78ResearchLab, 8, Yangpyeong-ro 25-gil, Yeongdeungpo-gu, Seoul, 07207, Republic of Korea
A Structured State Space Sequence Model for Multi-Class Classification of Malware
Oct 1, 2026Emmanuela Andam, Rana Shaaban, Emanuel Grant +1Cybersecurity Malware Classification
Artificial Intelligence Research (AIR) Center · School of Electrical Engineering and Computer Science, College of Engineering & Mines University of North Dakota, Grand Forks, ND 58201, USA
ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers
Sep 17, 2026Hyeongjun Choi, Wonyoung Jung, Haehoon Seo +1Adversarial Attacks on LLMs LLM Security
78ResearchLab Seoul, South Korea
ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection
Aug 4, 2026Md Faisal Ahmed, Zarin Tasnim Biash, Abu Raihan Shakil +4Android Malware Detection Malware Classification
Department of Computer Science and Engineering Brac University Dhaka, Bangladesh
Self-Supervised Representations for Binary Program Clustering: From Empirical Study to Retrieval-Augmented Learning
Aug 3, 2026Martin Mocko, Daniela ChudáRepresentation Learning Self-Supervised Learning
Faculty of Information Technology, Brno University of Technology, Brno, Czech Republic · Kempelen Institute of Intelligent Technologies (KInIT), Bratislava, Slovakia · Faculty of Electrical Engineering and Information Technology, Slovak University of Technology, Bratislava, Slovakia
Behavioral Grammar: Detecting Adaptive Malware via Tiny Language Model Priors and Second-Order Temporal Analysis
Aug 1, 2026Zihan LuoUnsupervised Anomaly Detection Malware Analysis
Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis
Jul 22, 2026Adel ElZemity, Shujun Li, Budi AriefMulti-Agent LLM Systems Small Language Models
University of Kent, Canterbury, United Kingdom
ThreatVisionAI: A Hybrid CNN-ViT Framework for Image-Based Malware Classification
Jul 4, 2026Allyson Taylor, Prashanth BusiReddyGariHybrid CNN-Transformer Architectures Malware Classification
Department of Mathematics & Computer Science University of North Carolina Pembroke
LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection
Jul 3, 2026Hang Gao, Xiaoyu Chen, Baoquan Cui +4Heterogeneous GNNs Hierarchical Representation Learning
Institute of Software, Chinese Academy of Sciences · University of Chinese Academy of Sciences
Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes
Jul 1, 2026Derek Everett, Edward Raff, James HoltMalware Classification Malware Analysis
Amazon, Baltimore, USA · CrowdStrike, Austin, USA
AI-Generated PowerShell Malware: An Experimental Framework and Dataset
Jun 29, 2026Luciano Pianese, Vittorio Orbinato, Pietro Liguori +1LLMs for Cybersecurity Malware Analysis
Department of Electrical Engineering and Information Technology (DIETI), Universit`a degli Studi di Napoli Federico II, Naples, Italy · Gran Sasso Science Institute, L’Aquila, Italy
A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution
Jun 29, 2026Jithin S., Roshin Sleeba C., Anvin Mariya P. B. +4Multi-Task Learning Malware Classification
Department of Computer Applications, Cochin University of Science and Technology, India · Department of Electrical, Computer and Biomedical Engineering, University of Pavia, Italy
Multi-View Decompilation for LLM-Based Malware Classification
Jun 18, 2026Bercan Turkmen, Vyas RainaSoftware Reverse Engineering LLM Prompting
Independent Researcher · SPARK
MASCOT-Android: A Curated Dataset and Automated Collection Pipeline for Android Malware Source Code Specimens
Jun 15, 2026Bojing Li, Duo Zhong, Prajna Bhandary +4Android Malware Detection Malware Analysis
University of Maryland, Baltimore County Baltimore, Maryland, USA
ViPER: Vision-based Packing-Aware Encoder for Robust Malware Detection
Jun 11, 2026Fatima Qaiser, Bisma Tahir, Muhammad Abid Mughal +1Malware Classification Malware Analysis
Department of Computer & Information Sciences, Pakistan Institute of Engineering & Applied Sciences (PIEAS), Islamabad, Pakistan
MOLOT System Card: Malicious Operational Logic Observation Transformer
Jun 5, 2026Daniil Lopatkin, Maksim Mitrofanov, Stanislav Rakovsky +1Static Code Analysis Malware Classification
Data Science & ML Dept. Positive Technologies False Positive Community
AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification
Jun 5, 2026Parthajit Borah, Sakshi Singh, D. K. Bhattacharyya +1Malware Classification Malware Analysis
School of Cyber Security and Digital Forensics, National Forensic Sciences University,Guwahati. · Department of Computer Science and Engineering, Tezpur University, Tezpur, 784028, Assam, India. · Computer Science, College of Engineering and Applied Science, University of Colorado,Colorado Springs, CO 80933-7150, Colorado, USA.
MalTree: Tracing Malware Evolution from Embeddings at Scale
Jun 4, 2026Akash Amalan, Georgios Smaragdakis, Tom J. VieringPhylogenetic Inference Malware Analysis
Delft University of Technology, Delft, The Netherlands.
AI Agents Enable Adaptive Computer Worms
Jun 2, 2026Jonas Guan, Tom Blanchard, Hanna Foerster +3Cybersecurity Malware Analysis
University of Toronto · University of Cambridge · 4ServiceNow
High-Precision APT Malware Attribution with Out-of-Scope Resilience
Jun 2, 2026Peter Williams, Adam Sobey, Erisa KarafiliSelective Prediction Malware Classification
University of Southampton, Southampton, UK · The Alan Turing Institute, London, UK
A Hybrid Approach For Malware Classification Using Secondary Features Fusion
Jun 2, 2026Raja Khurram Shahzad, Muhammad Mustaqeem, Haroon ElahiMalware Classification Malware Analysis
Department of Computer and System Science, Mid Sweden University, Östersund Campus, Jämtland, Sweden. · Department of Engineering, Arbisoft (Pvt.) Ltd., Lahore, Punjab, Pakistan. · Department of Computing Science and Engineering, Chalmers University of Technology, Gothenburg, Västerbotten, Sweden.
Large Byte Model: Teaching Language Models About Compiled Code
Jun 1, 2026Florian Störtz, Catalin-Andrei Stan, Alexandru Dinu +4Malware Classification Byte-Level Language Model
CrowdStrike · CrowdStrike U.K. · CrowdStrike Romania +1
MAECO-Lite: Modular Ontology for Dynamic Malware Analysis
May 29, 2026Zekeri Adams, Peter Švec, Ján Kľuka +4Malware Analysis
Department of Applied Informatics, Comenius University in Bratislava, Mlynská dolina, 842 48 Bratislava, Slovakia · Institute of Computer Science and Mathematics, Faculty of Electrical Engineering and Information Technology, Slovak University of Technology, Ilkoviˇcova 3, Bratislava, Slovakia
Automatically Attacking Software Reverse Engineering AI Agents
May 28, 2026Brian Crawford, Justin Phillips, Patrick McClureSoftware Engineering Adversarial Prompt Generation
Naval Postgraduate School, Monterey, CA, United States
Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem
May 27, 2026Luca Beurer-Kellner, Aleksei Kudrinskii, Marco Milanta +3AI Agent Security Malware Analysis
1Snyk
Building an Adversarial Malware Dataset by Family and Type: Generation, Evasion, and Poisoning Evaluation
May 25, 2026David Košťál, Martin JurečekAdversarial Attacks Malware Classification
Department of Information Security, Faculty of Information Technology, Czech Technical University in Prague
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
May 24, 2026Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram murthy Chebiyam +2Concept Drift Continual Learning
Indian Institute of Technology Ropar, India · Indian Institute of Technology Hyderabad, India
Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection
May 22, 2026Ahmed Sabbah, Mohammad Kharma, Mohammad Alkhanafseh +3Reinforcement Learning Concept Drift
Birzeit University · University of Central Florida
Adversarial Vulnerability Under Temporal Concept Drift: A Longitudinal Study of Android Malware Detection
May 22, 2026Ahmed Sabbah, Mohammed Kharma, Radi Jarrar +2Distribution Shift Robustness Concept Drift
aDepartment of Computer Science, Birzeit University, P.O. Box 14, Birzeit, P627, West2026 Bank, Palestine · bDepartment of Computer Science, University of Central Florida, 4328 Scorpius St., Building 116, Room 246, Orlando, 32816, FL, USAMay 22
Learning to Look Benign: Targeted Evasion of Malware Detectors via API Import Injection
May 18, 2026Juozas Dautartas, Olga Kurasova, Juozapas Rokas Čypas +1Adversarial Attacks Malware Classification
Institute of Data Science and Digital Technologies, Faculty of Mathematics and Informatics, Vilnius University, LT-08412 Vilnius, Lithuania

Oct 7, 2026, cs.CRJ/K move · Enter open · S save

MARS: Malware Analysis with Rule-Based Scoring of LLM Claims

Hyeongjun Choi

78ResearchLab, 8, Yangpyeong-ro 25-gil, Yeongdeungpo-gu, Seoul, 07207, Republic of Korea

Malware Classification LLMs for Cybersecurity Malware Analysis LLM Evaluation

Open paper AskPDF arXiv

Large language models can triage malware through direct verdicts or behavioral claims scored by an external policy. We present MARS, a malware triage framework, and compare direct classification with single-pass claim scoring using the same evidence collector and identical static evidence bundles for each model. The evaluation covers 1,195 PE and ELF binaries grouped into 1,001 near-duplicate clusters and six language models, with deterministic rules providing a baseline. Direct classification is more accurate for all six models. On samples with usable outputs from both paths, its accuracy advantage ranges from 3.7 to 20.9 percentage points, with all 95% cluster-bootstrap confidence intervals for the differences above zero. It also achieves higher malicious alert recall in ten of twelve platform and model combinations. Claim mediation provides no consistent reduction in performance variation across models. Separate subset studies find more consistent alert decisions for direct classification and a larger recall loss for the claim path when predefined indicator fields are removed. In a family identification probe, claims yield higher accuracy than verdict labels but lower accuracy than evidence text. Retained claims expose the inputs to verdict computation and permit policy revision without another model call. We reproduce archived verdicts exactly and apply a revised policy to the same records, including outputs from two additional models withdrawn by their provider. Under the evaluated claim taxonomy and additive policy, these results favor direct classification when only a verdict is required, while demonstrating that retained claims support explicit policy inspection and revision.

Momentum

Related topics

Latest papers 51