LLMs recover IoCs from lightweight-obfuscated JavaScript but performance collapses under encryption in a new benchmark of 336 programs across 12 concealment levels.
Exploring llms for malware detection: Review, framework design, and countermeasure approaches
4 Pith papers cite this work. Polarity classification is still indexing.
4
Pith papers citing it
fields
cs.CR 4years
2026 4verdicts
UNVERDICTED 4representative citing papers
Multi-decompiler prompting improves LLM malware classification F1 by supplying complementary views of the same binary.
ABLE uses LLMs with sanitization and iterative refinement to generate bypass YARA rules from malware traces, achieving 79% success on 334 samples and 47% more family detections.
LCC-LLM creates a code-centric dataset and RAG-based LLM framework that reaches 0.634 average semantic similarity on 43 malware tasks and 10/10 pass rate in real-world case studies.
citing papers explorer
-
Benchmarking Large Language Models for IoC Recovery under Adversarial Code Obfuscation and Encryption
LLMs recover IoCs from lightweight-obfuscated JavaScript but performance collapses under encryption in a new benchmark of 336 programs across 12 concealment levels.
-
Multi-View Decompilation for LLM-Based Malware Classification
Multi-decompiler prompting improves LLM malware classification F1 by supplying complementary views of the same binary.
-
A Large Language Model Approach to Generating Bypass Rules for Malware Evasion in Analysis Sandbox
ABLE uses LLMs with sanitization and iterative refinement to generate bypass YARA rules from malware traces, achieving 79% success on 334 samples and 47% more family detections.
-
LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution
LCC-LLM creates a code-centric dataset and RAG-based LLM framework that reaches 0.634 average semantic similarity on 43 malware tasks and 10/10 pass rate in real-world case studies.