Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering

Hamed Jelodar, Samita Bai, Parisa Hamedi, Hesamodin Mohammadian, Roozbeh Razavi-Far, Ali Ghorbani

TL;DR

This review surveys the role of large language models in malware code analysis, spanning static and dynamic malware analysis, reverse engineering, and defense-oriented code inspection. It synthesizes methods, datasets, prompting strategies, and fine-tuning approaches, distinguishing general-purpose LLMs from specialized offensive models. Key contributions include mapping environments (Android, Java, websites, Windows), outlining dataset augmentation and few-/zero-shot techniques, and highlighting both opportunities and limitations such as data quality and safety. The work also identifies future directions—knowledge graphs, KE-PLMs, and hybrid RE pipelines—that could strengthen proactive cybersecurity and resilience against evolving threats.

Abstract

Large Language Models (LLMs) have recently emerged as powerful tools in cybersecurity, offering advanced capabilities in malware detection, generation, and real-time monitoring. Numerous studies have explored their application in cybersecurity, demonstrating their effectiveness in identifying novel malware variants, analyzing malicious code structures, and enhancing automated threat analysis. Several transformer-based architectures and LLM-driven models have been proposed to improve malware analysis, leveraging semantic and structural insights to recognize malicious intent more accurately. This study presents a comprehensive review of LLM-based approaches in malware code analysis, summarizing recent advancements, trends, and methodologies. We examine notable scholarly works to map the research landscape, identify key challenges, and highlight emerging innovations in LLM-driven cybersecurity. Additionally, we emphasize the role of static analysis in malware detection, introduce notable datasets and specialized LLM models, and discuss essential datasets supporting automated malware research. This study serves as a valuable resource for researchers and cybersecurity professionals, offering insights into LLM-powered malware detection and defence strategies while outlining future directions for strengthening cybersecurity resilience.

Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering

TL;DR

This review surveys the role of large language models in malware code analysis, spanning static and dynamic malware analysis, reverse engineering, and defense-oriented code inspection. It synthesizes methods, datasets, prompting strategies, and fine-tuning approaches, distinguishing general-purpose LLMs from specialized offensive models. Key contributions include mapping environments (Android, Java, websites, Windows), outlining dataset augmentation and few-/zero-shot techniques, and highlighting both opportunities and limitations such as data quality and safety. The work also identifies future directions—knowledge graphs, KE-PLMs, and hybrid RE pipelines—that could strengthen proactive cybersecurity and resilience against evolving threats.

Abstract

Large Language Models (LLMs) have recently emerged as powerful tools in cybersecurity, offering advanced capabilities in malware detection, generation, and real-time monitoring. Numerous studies have explored their application in cybersecurity, demonstrating their effectiveness in identifying novel malware variants, analyzing malicious code structures, and enhancing automated threat analysis. Several transformer-based architectures and LLM-driven models have been proposed to improve malware analysis, leveraging semantic and structural insights to recognize malicious intent more accurately. This study presents a comprehensive review of LLM-based approaches in malware code analysis, summarizing recent advancements, trends, and methodologies. We examine notable scholarly works to map the research landscape, identify key challenges, and highlight emerging innovations in LLM-driven cybersecurity. Additionally, we emphasize the role of static analysis in malware detection, introduce notable datasets and specialized LLM models, and discuss essential datasets supporting automated malware research. This study serves as a valuable resource for researchers and cybersecurity professionals, offering insights into LLM-powered malware detection and defence strategies while outlining future directions for strengthening cybersecurity resilience.

Paper Structure

This paper contains 83 sections, 13 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Core Concepts of LLMs
  4. Related Work
  5. Malware Analysis: LLMs in Static & Dynamic
  6. Static Approaches
  7. Static Approaches using LLM
  8. Iterative Malware Summarization
  9. Dynamic Approaches
  10. Dynamic Approaches using LLM on API calls
  11. LLM for Malicious Code Detection
  12. Applications and Environments
  13. Static Malware Analysis for Android
  14. Static Analysis of Malware in Java
  15. Static Malware Analysis of Websites
  16. ...and 68 more sections

Figures (13)

  • Figure 1: An overview of various malware code aspects explored in this research
  • Figure 2: A general view of malware analysis based on static and dynamic ideas for feeding LLM.
  • Figure 3: A general view of application of malicious code analysis based on different environments.
  • Figure 4: A bibliometric analysis and visualization of potential LLM and NLP methods for malware code analysis.
  • Figure 5: A sample prompt for malware code analysis using zero-shot approach for websites
  • ...and 8 more figures