Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

MalCVE: Malware Detection and CVE Association Using Large Language Models

Eduard Andrei Cristea, Petter Molnes, Jingyue Li

TL;DR

This work tackles the problem of linking binary malware to exploited CVEs by introducing MalCVE, a pipeline that combines decompilation, light deobfuscation, and large language model prompting with retrieval-augmented generation to detect malware in Java JARs and associate CVEs. Using the MalDICT dataset of 3{,}839 JARs, MalCVE achieves a mean malware-detection accuracy of 97% and recall@10 for CVE association up to 65%, at a fraction of the cost of commercial tools. The approach demonstrates that generic LLMs, when paired with effective preprocessing and RAG, can perform end-to-end malware analysis with explainable CVE mappings, offering a scalable, accessible alternative for researchers and practitioners. Limitations include dependence on CVE descriptions for precise mapping and the sensitivity of results to deobfuscation quality, with future work expanding language support, open-source LLMs, and additional vulnerability sources to improve robustness.

Abstract

Malicious software attacks are having an increasingly significant economic impact. Commercial malware detection software can be costly, and tools that attribute malware to the specific software vulnerabilities it exploits are largely lacking. Understanding the connection between malware and the vulnerabilities it targets is crucial for analyzing past threats and proactively defending against current ones. In this study, we propose an approach that leverages large language models (LLMs) to detect binary malware, specifically within JAR files, and utilizes the capabilities of LLMs combined with retrieval-augmented generation (RAG) to identify Common Vulnerabilities and Exposures (CVEs) that malware may exploit. We developed a proof-of-concept tool called MalCVE, which integrates binary code decompilation, deobfuscation, LLM-based code summarization, semantic similarity search, and CVE classification using LLMs. We evaluated MalCVE using a benchmark dataset of 3,839 JAR executables. MalCVE achieved a mean malware detection accuracy of 97%, at a fraction of the cost of commercial solutions. It is also the first tool to associate CVEs with binary malware, achieving a recall@10 of 65%, which is comparable to studies that perform similar analyses on source code.

MalCVE: Malware Detection and CVE Association Using Large Language Models

TL;DR

This work tackles the problem of linking binary malware to exploited CVEs by introducing MalCVE, a pipeline that combines decompilation, light deobfuscation, and large language model prompting with retrieval-augmented generation to detect malware in Java JARs and associate CVEs. Using the MalDICT dataset of 3{,}839 JARs, MalCVE achieves a mean malware-detection accuracy of 97% and recall@10 for CVE association up to 65%, at a fraction of the cost of commercial tools. The approach demonstrates that generic LLMs, when paired with effective preprocessing and RAG, can perform end-to-end malware analysis with explainable CVE mappings, offering a scalable, accessible alternative for researchers and practitioners. Limitations include dependence on CVE descriptions for precise mapping and the sensitivity of results to deobfuscation quality, with future work expanding language support, open-source LLMs, and additional vulnerability sources to improve robustness.

Abstract

Malicious software attacks are having an increasingly significant economic impact. Commercial malware detection software can be costly, and tools that attribute malware to the specific software vulnerabilities it exploits are largely lacking. Understanding the connection between malware and the vulnerabilities it targets is crucial for analyzing past threats and proactively defending against current ones. In this study, we propose an approach that leverages large language models (LLMs) to detect binary malware, specifically within JAR files, and utilizes the capabilities of LLMs combined with retrieval-augmented generation (RAG) to identify Common Vulnerabilities and Exposures (CVEs) that malware may exploit. We developed a proof-of-concept tool called MalCVE, which integrates binary code decompilation, deobfuscation, LLM-based code summarization, semantic similarity search, and CVE classification using LLMs. We evaluated MalCVE using a benchmark dataset of 3,839 JAR executables. MalCVE achieved a mean malware detection accuracy of 97%, at a fraction of the cost of commercial solutions. It is also the first tool to associate CVEs with binary malware, achieving a recall@10 of 65%, which is comparable to studies that perform similar analyses on source code.
Paper Structure (36 sections, 10 figures, 1 table)

This paper contains 36 sections, 10 figures, 1 table.

Table of Contents

  1. Introduction
  2. Related Work
  3. Malware Detection Using LLMs
  4. Vulnerability Detection in Source Code Using LLM and RAG
  5. Our approach and MalCVE implementation
  6. Approach design
  7. Decompilation
  8. Deobfuscation
  9. Summarization of the code
  10. Generating Search Queries
  11. Semantic Similarity Search
  12. Re-ranking the Semantic Search Result
  13. Associating malicious JAR files to CVEs
  14. Save Results to File
  15. MalCVE implementation
  16. ...and 21 more sections

Figures (10)

  • Figure 1: Before and After Decompilation Comparison
  • Figure 2: Example Prompt: Summarizing Decompiled Malware (To save space, the decompiled code is substituted with a placeholder.)
  • Figure 3: An Example Output
  • Figure 4: Prompt: Generate Search Queries
  • Figure 5: An Example of Result Queries Before and After Aggregation
  • ...and 5 more figures