Rethinking and Exploring String-Based Malware Family Classification in the Era of LLMs and RAG
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2025
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866918171903000576 |
|---|---|
| author | Chen, Yufan Wu, Daoyuan Zhong, Juantao Zhang, Zicheng Gao, Debin Wang, Shuai Li, Yingjiu Liu, Ning Chen, Jiachi Chang, Rocky K. C. |
| author_facet | Chen, Yufan Wu, Daoyuan Zhong, Juantao Zhang, Zicheng Gao, Debin Wang, Shuai Li, Yingjiu Liu, Ning Chen, Jiachi Chang, Rocky K. C. |
| contents | Malware family classification aims to identify the specific family (e.g., GuLoader or BitRAT) a malware sample may belong to, in contrast to malware detection or sample classification, which only predicts a Yes/No outcome. Accurate family identification can greatly facilitate automated sample labeling and understanding on crowdsourced malware analysis platforms such as VirusTotal and MalwareBazaar, which generate vast amounts of data daily. In this paper, we explore and assess the feasibility of using traditional binary string features for family classification in the new era of large language models (LLMs) and Retrieval-Augmented Generation (RAG). Specifically, we investigate howFamily-Specific String (FSS) features can be utilized in a manner similar to RAG to facilitate family classification. To this end, we develop a curated evaluation framework covering 4,347 samples from 67 malware families, extract and analyze over 25 million strings, and conduct detailed ablation studies to assess the impact of different design choices in four major modules, with each providing a relative improvement ranging from 8.1% to 120%. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2507_04055 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Rethinking and Exploring String-Based Malware Family Classification in the Era of LLMs and RAG Chen, Yufan Wu, Daoyuan Zhong, Juantao Zhang, Zicheng Gao, Debin Wang, Shuai Li, Yingjiu Liu, Ning Chen, Jiachi Chang, Rocky K. C. Cryptography and Security Artificial Intelligence Software Engineering Malware family classification aims to identify the specific family (e.g., GuLoader or BitRAT) a malware sample may belong to, in contrast to malware detection or sample classification, which only predicts a Yes/No outcome. Accurate family identification can greatly facilitate automated sample labeling and understanding on crowdsourced malware analysis platforms such as VirusTotal and MalwareBazaar, which generate vast amounts of data daily. In this paper, we explore and assess the feasibility of using traditional binary string features for family classification in the new era of large language models (LLMs) and Retrieval-Augmented Generation (RAG). Specifically, we investigate howFamily-Specific String (FSS) features can be utilized in a manner similar to RAG to facilitate family classification. To this end, we develop a curated evaluation framework covering 4,347 samples from 67 malware families, extract and analyze over 25 million strings, and conduct detailed ablation studies to assess the impact of different design choices in four major modules, with each providing a relative improvement ranging from 8.1% to 120%. |
| title | Rethinking and Exploring String-Based Malware Family Classification in the Era of LLMs and RAG |
| topic | Cryptography and Security Artificial Intelligence Software Engineering |
| url | https://arxiv.org/abs/2507.04055 |