Source-linked AI summary
Exploring Large Language Models for Semantic Analysis and Categorization of Android Malware
Brandon J Walton, Mst Eshita Khatun, James M Ghawaly, Aisha Ali-Gombe
TL;DR
Reverse engineering complex and evolving Android malware is time-consuming, especially for novel or zero-day samples. MalParse combines hierarchical code summarization with strategic prompting to analyze and categorize Android applications. It achieved 77% categorization with Malware-Scoped prompts, and its summaries could be traced back to code associated with malicious behavior.
Problem
Reverse engineering malware is complex and time-consuming, particularly for advanced or obfuscated Android malware and suspected novel or zero-day samples.
Source: §1 · p. 1Method
MalParse uses hierarchical function-, class-, and package-level code summaries with prompt engineering to guide LLM-based Android malware analysis and categorization.
Source: §1 · p. 1, §3.2 · p. 3, §3.3 · p. 3Results
Takeaways & Limitations
Backtracking from package-level summaries to function-level summaries identified code associated with malicious behavior and explained the model’s decision.
Source: §5 · p. 7MalParse’s summarization and categorization depend on GPT-4o-mini and prompt robustness, and static summarization can be less comprehensive for stealthy, obfuscated samples.
Source: §4.3.1 · p. 6
Abstract
from arXiv · showhide
Malware analysis is a complex process of examining and evaluating malicious software's functionality, origin, and potential impact. This arduous process typically involves dissecting the software to understand its components, infection vector, propagation mechanism, and payload. Over the years, deep reverse engineering of malware has become increasingly tedious, mainly due to modern malicious codebases' fast evolution and sophistication. Essentially, analysts are tasked with identifying the elusive needle in the haystack within the complexities of zero-day malware, all while under tight time constraints. Thus, in this paper, we explore leveraging Large Language Models (LLMs) for semantic malware analysis to expedite the analysis of known and novel samples. Built on GPT-4o-mini model, \msp is designed to augment malware analysis for Android through a hierarchical-tiered summarization chain and strategic prompt engineering. Additionally, \msp performs malware categorization, distinguishing potential malware from benign applications, thereby saving time during the malware reverse engineering process. Despite not being fine-tuned for Android malware analysis, we demonstrate that through optimized and advanced prompt engineering \msp can achieve up to 77% classification accuracy while providing highly robust summaries at functional, class, and package levels. In addition, leveraging the backward tracing of the summaries from package to function levels allowed us to pinpoint the precise code snippets responsible for malicious behavior.
1. Introduction
MalParse applies hierarchical code summarization and prompt engineering to Android malware analysis, aiming to help analysts categorize applications and trace malicious behavior. On 200 Android applications, Malware-Scoped prompting achieved a 77% categorization rate, outperforming the other tested prompt types.
1. Introduction
- Reverse engineering advanced, obfuscated Android malware is skill-intensive, time-consuming, and complex.The paper frames these demands as a challenge for analysts working with evolving malware.Source: §1 · p. 1
- MalParse combines decompilation, prompt engineering, and hierarchical-tiered code summarization to categorize Android applications as malicious or benign.Summaries proceed from functions to classes to packages, while prompts guide the model toward functionality, APIs and permissions, or malicious indicators.Source: §1 · p. 1
- 77% categorization with Malware-Scoped prompting exceeded Vanilla prompting at 49.5% and API-Scoped prompting at 56%.The evaluation used 200 Android applications, evenly split between malware and benign samples.Source: §1 · pp. 1–2
- Function-, class-, and package-level summaries are intended to provide comprehensive, contextually relevant information for security analysis.The authors describe these summaries as providing precise and actionable insights.Source: §1 · p. 2
- Backtracking through summaries links package-level decisions to code-level root causes and helps analysts inspect the model’s reasoning about functionality.The authors describe this as a way to identify the code responsible for malicious activity.Source: §1 · p. 2
2. Literature Review
The literature review situates MalParse among code-summarization and LLM research, then distinguishes its Android-focused, hierarchical approach. It also identifies strategic prompting as central to its approach to malware categorization and description.
2. Literature Review
- Automated code summarization generates natural-language descriptions of source code, and its use in security is presented as relevant to analyzing malware threats.The review introduces LLMs as a recent focus for code documentation, repair, and testing.Source: §2 · p. 2, §2.1 · p. 2
2.1. LLMs for Code Summarization
- Prior work covers CodeBERT [1], GraphCodeBERT [2], PLBART [3], and foundational LLMs for programming tasks, while studies also examine ChatGPT for automated bug resolution,,, [8],.Zahan et al. [10] investigated LLMs for JavaScript malware detection in the npm ecosystem.Source: §2.1 · p. 2
- MalParse differs by applying hierarchical function-, class-, and package-level summaries to Android malware categorization and package-level descriptions for analyst review.The review also points to prompt engineering as important for categorization and enhanced descriptions.Source: §2.1 · p. 2
3. Design and Implementation
MalParse decompiles Android applications, summarizes code from function to package level, and uses prompts to steer the model toward malware-relevant analysis. The design combines prompt categories with few-shot examples, contextual cues, and external knowledge in some package-level prompts.
3. Design and Implementation
- The design comprises auto-decompilation and static feature extraction, hierarchical-tiered summarization, and prompt-based model optimization for APK analysis.The method is framed as three primary steps.Source: §3 · p. 2
3.1. Auto-decompilation and Feature Extraction Module
- The decompilation workflow uses Dex2Jar and CFR to turn an APK’s bytecode into human-readable source code.Android apps are described as Java applications compiled into a compressed intermediate format called Davik Bytecode (Dex).Source: §3.1 · pp. 2–3
3.2. Hierarchical-Tiered Code Summarization
- The summarization module works bottom-up from individual functions to classes and then the full package, supporting restricted context windows and large-code summarization.The workflow is implemented in Python and designed to work with general-purpose LLMs; Figure 1 depicts the function-to-class-to-package sequence.Source: §3.2 · p. 3, Figure 1 · p. 3
3.3. Model Optimization using Advanced Prompt Engineering
- Vanilla prompts provide no suspicious-feature guidance, API-Scoped prompts emphasize sensitive APIs and permissions, and Malware-Scoped prompts cue malicious functions and malware types.Examples of malware cues include dynamic class loading, rooting, and data exfiltration.Source: §3.3 · p. 3
- Prompting combines few-shot input/output examples, injected API and malware context, and external knowledge in API- and Malware-Scoped package summaries.The authors describe the design as a foundation that could be adapted beyond Android malware analysis.Source: §3.3 · pp. 3–4
4. Evaluation
MalParse was evaluated on 200 Android applications for malware categorization under three prompt scopes and for package-to-function summary tracing. Malware-scoped prompting achieved the highest reported categorization rate, while the discussion notes limitations from static analysis, decompilation, and prompt coverage.
4.1. Experimental Setup.
- The evaluation used 200 APKs split evenly between known malware and benign apps, without fine-tuning on known examples.The evaluation assessed categorization across prompt scopes and the efficacy of package-level summaries.Source: §4.1 · p. 4, §4 · p. 4
4.2.1. R1 - Evaluation of the Categorization Accuracy.
- 49.5% accuracy with Vanilla prompts reflected 92% correct benign classifications but only 7% correct malware classifications.The only identified malware samples were associated with tracking user activity.Source: §4.2.1 · p. 4, Table 1 · p. 4
- 56% accuracy with API-Scoped prompts came with bias toward Java reflection APIs, with APKs using reflection tending to be classified as malicious.The prompts supplied context about APIs, libraries, and permissions common in Android malware.Source: §4.2.1 · pp. 4–5, Table 2 · p. 5
- 77% of applications were correctly classified with Malware-Scoped prompts, versus 45.5% with Vanilla and 56% with API-Scoped prompts; 22% were misclassified.The authors suggest suspicious activities not covered by the prompt may have been missed.Source: §4.2.1 · p. 5, Table 3 · p. 5
4.2.2. R2 - Evaluation of the Summary Efficacy.
- For the sample identified by hash 9324376e27f9e1ddd05d181d656c6b76, tracing linked a package-level rooting assessment to RTAccessHandler and the functions initRoot() and executeRoot().The function-level summary showed initRoot() calling b() to load and execute a dynamic class; another initRoot() instance used Java Reflection.Source: §4.2.2 · p. 5, Table 4 · p. 5
4.3. Discussion.
- The discussion describes Chain-Of-Thought processes as improving the depth and traceability of model decisions.The authors identify understanding how and why malware behaves as important alongside its payload.Source: §4.3 · p. 5
4.3.1. Limitations.
- MalParse depends on GPT-4o-mini and prompt robustness; static summarization can miss obfuscated functionality, and decompilation failures led some malware samples to be labeled benign.The reported 24% false-positive and 22% false-negative rates could cause overlooked threats or unnecessary resource expenditure.Source: §4.3.1 · p. 6
4.3.2. Future Work.
- Future work proposes refining prompts, using a locally hosted smaller open-source LLM, and summarizing bytecode directly rather than decompiled Java.The authors plan to test the redesigned approach on larger Android APK sample sets.Source: §4.3.2 · p. 6
5. Conclusion
MalParse uses hierarchical code summarization and prompt engineering for semantic analysis of Android applications. It reports 77% malware-classification accuracy without prior training and traces package-level summaries back to functions implicated in malicious behavior.
5. Conclusion
- MalParse summarizes code hierarchically to support malware classification and understanding of application structure and behavior.Source: §5 · pp. 6–7
- 77% accuracy without prior training; MalParse classified malware and produced summaries similar to those from automated engines.The system uses hierarchical-tiered code summarization and advanced prompt engineering.Source: §5 · p. 7
- Backward tracing links package-level summaries to function-level summaries, describing malicious behavior’s root cause and explaining the model’s decision.Source: §5 · p. 7