# AppPoet: Large Language Model based Android malware detection via multi-view prompt engineering

arXiv: https://arxiv.org/abs/2404.18816 · HTML: https://mlsanity.com/paper/2404.18816/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Apr 2024.

## Built on by (most cited first, 16 of 16)

- [LAMD: Context-driven Android Malware Detection and Classification with LLMs](https://mlsanity.com/paper/2502.13055/) (2025)
- [Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering](https://mlsanity.com/paper/2504.07137/) (2025)
- [On Benchmarking Code LLMs for Android Malware Analysis](https://mlsanity.com/paper/2504.00694/) (2025)
- [A Contemporary Survey of Large Language Model Assisted Program Analysis](https://mlsanity.com/paper/2502.18474/) (2025)
- [Malware Detection at the Edge with Lightweight LLMs: A Performance Evaluation](https://mlsanity.com/paper/2503.04302/) (2025)
- [Gen-AI for User Safety: A Survey](https://mlsanity.com/paper/2411.06606/) (2024)
- [LoRA-based Parameter-Efficient LLMs for Continuous Learning in Edge-based Malware Detection](https://mlsanity.com/paper/2602.11655/) (2026)
- [Trident: Improving Malware Detection with LLMs and Behavioral Features](https://mlsanity.com/paper/2605.00297/) (2026)
- [Enhancing Android Malware Detection with Retrieval-Augmented Generation](https://mlsanity.com/paper/2506.22750/) (2025)
- [LLM-Based Identification of Infostealer Infection Vectors from Screenshots: The Case of Aurora](https://mlsanity.com/paper/2507.23611/) (2025)
- [LLM-Generated Samples for Android Malware Detection](https://mlsanity.com/paper/2510.02391/) (2025)
- [UIXPOSE: Mobile Malware Detection via Intention-Behaviour Discrepancy Analysis](https://mlsanity.com/paper/2512.14130/) (2025)
- [LLM-Driven Feature-Level Adversarial Attacks on Android Malware Detectors](https://mlsanity.com/paper/2512.21404/) (2025)
- [Multi-View Decompilation for LLM-Based Malware Classification](https://mlsanity.com/paper/2606.20436/) (2026)
- [Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection](https://mlsanity.com/paper/2608.27994/) (2026)
- [BadQubits: An LLM-Based Framework for Static Pre-Execution Detection of Structurally Harmful Quantum Circuits](https://mlsanity.com/paper/2609.18965/) (2026)

## Abstract (arXiv)

Due to the vast array of Android applications, their multifarious functions and intricate behavioral semantics, attackers can adopt various tactics to conceal their genuine attack intentions within legitimate functions. However, numerous learning-based methods suffer from a limitation in mining behavioral semantic information, thus impeding the accuracy and efficiency of Android malware detection. Besides, the majority of existing learning-based methods are weakly interpretive and fail to furnish researchers with effective and readable detection reports. Inspired by the success of the Large Language Models (LLMs) in natural language understanding, we propose AppPoet, a LLM-assisted multi-view system for Android malware detection. Firstly, AppPoet employs a static method to comprehensively collect application features and formulate various observation views. Then, using our carefully crafted multi-view prompt templates, it guides the LLM to generate function descriptions and behavioral summaries for each view, enabling deep semantic analysis of the views. Finally, we collaboratively fuse the multi-view information to efficiently and accurately detect malware through a deep neural network (DNN) classifier and then generate the human-readable diagnostic reports. Experimental results demonstrate that our method achieves a detection accuracy of 97.15% and an F1 score of 97.21%, which is superior to the baseline methods. Furthermore, the case study evaluates the effectiveness of our generated diagnostic reports.