Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

XGen-Q: An Explainable Domain-Adaptive LLM Framework with Retrieval-Augmented Generation for Software Security

Hamed Jelodar, Mohammad Meymani, Roozbeh Razavi-Far, Ali A. Ghorbani

TL;DR

Problem: Detecting and analyzing malware with AI is challenging due to obfuscation and unseen threats. The authors present XGen-Q, a domain-adapted LLM based on Qwen-Coder, pretrained on over one million malware samples in source and assembly, and enhanced with retrieval-augmented generation and a two-stage prompt design for forensic reporting and final classification. Key contributions include domain-specific pretraining, RAG integration with MITRE ATT&CK knowledge, a split prompt architecture for interpretability and automation, and semantic post-processing for auditability. Results show lower perplexity than baselines and strong generalization to novel malware, indicating practical potential for explainable automated malware analysis.

Abstract

Generative AI and large language models (LLMs) have shown strong capabilities in code understanding, but their use in cybersecurity, particularly for malware detection and analysis, remains limited. Existing detection systems often fail to generalize to obfuscated or previously unseen threats, underscoring the need for more adaptable and explainable models. To address this challenge, we introduce XGen-Q, a domain-adapted LLM built on the Qwen-Coder architecture and pretrained on a large-scale corpus of over one million malware samples, spanning both source and assembly code. XGen-Q uses a multi-stage prompt strategy combined with retrieval-augmented generation (RAG) to deliver reliable malware identification and detailed forensic reporting, even in the presence of complex code obfuscation. To further enhance generalization, we design a training pipeline that systematically exposes the model to diverse obfuscation patterns. Experimental results show that XGen-Q achieves significantly lower perplexity than competitive baselines and exhibits strong performance on novel malware samples, demonstrating the promise of LLM-based approaches for interpretable and robust malware analysis.

XGen-Q: An Explainable Domain-Adaptive LLM Framework with Retrieval-Augmented Generation for Software Security

TL;DR

Problem: Detecting and analyzing malware with AI is challenging due to obfuscation and unseen threats. The authors present XGen-Q, a domain-adapted LLM based on Qwen-Coder, pretrained on over one million malware samples in source and assembly, and enhanced with retrieval-augmented generation and a two-stage prompt design for forensic reporting and final classification. Key contributions include domain-specific pretraining, RAG integration with MITRE ATT&CK knowledge, a split prompt architecture for interpretability and automation, and semantic post-processing for auditability. Results show lower perplexity than baselines and strong generalization to novel malware, indicating practical potential for explainable automated malware analysis.

Abstract

Generative AI and large language models (LLMs) have shown strong capabilities in code understanding, but their use in cybersecurity, particularly for malware detection and analysis, remains limited. Existing detection systems often fail to generalize to obfuscated or previously unseen threats, underscoring the need for more adaptable and explainable models. To address this challenge, we introduce XGen-Q, a domain-adapted LLM built on the Qwen-Coder architecture and pretrained on a large-scale corpus of over one million malware samples, spanning both source and assembly code. XGen-Q uses a multi-stage prompt strategy combined with retrieval-augmented generation (RAG) to deliver reliable malware identification and detailed forensic reporting, even in the presence of complex code obfuscation. To further enhance generalization, we design a training pipeline that systematically exposes the model to diverse obfuscation patterns. Experimental results show that XGen-Q achieves significantly lower perplexity than competitive baselines and exhibits strong performance on novel malware samples, demonstrating the promise of LLM-based approaches for interpretable and robust malware analysis.
Paper Structure (21 sections, 8 figures, 2 tables, 2 algorithms)

This paper contains 21 sections, 8 figures, 2 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Works
  3. Methodology
  4. Phase 1: Dataset Collection and Preparation
  5. Phase 2: Domain-Specific Pre-Training
  6. Importance of Domain Adaptation
  7. Pre-training on Malware samples
  8. Phase 3: Model Architecture and Training
  9. Phase 4: LLM-Prompt Design for Security Tasks
  10. Prompt 1 - Expert Malware Behavior Classification
  11. Prompt 2 - Final Behavior Classification
  12. Phase 5: Semantic Handling and Post-Processing
  13. Semantic Extraction
  14. Analyst Review and Auditability
  15. Experiments and Implementation
  16. ...and 6 more sections

Figures (8)

  • Figure 1: This figure illustrates a simple interaction between an input code and our proposed framework, where the system has labeled the input as malware.
  • Figure 2: The general diagram of the proposed framework.
  • Figure 3: Knowledge injection based on MITRE ATT&CK, to build guidance for Prompt 1, and prompt 2 creation based on prompt 1's output.
  • Figure 4: Training metrics of XGen-Q showing loss reduction, gradient behavior and, learning rate decay.
  • Figure 5: Example of a sample considered as malware.
  • ...and 3 more figures