mlsanityData to 7 Oct 2026

LAMD: Context-driven Android Malware Detection and Classification with LLMs

arXiv 2502.13055 ↗First posted 18 Feb 2025cs.CR cs.AI cs.LGcited by 18

Not on the map. Why?

Abstract (arXiv)

The rapid growth of mobile applications has escalated Android malware threats. Although there are numerous detection methods, they often struggle with evolving attacks, dataset biases, and limited explainability. Large Language Models (LLMs) offer a promising alternative with their zero-shot inference and reasoning capabilities. However, applying LLMs to Android malware detection presents two key challenges: (1)the extensive support code in Android applications, often spanning thousands of classes, exceeds LLMs' context limits and obscures malicious behavior within benign functionality; (2)the structural complexity and interdependencies of Android applications surpass LLMs' sequence-based reasoning, fragmenting code analysis and hindering malicious intent inference. To address these challenges, we propose LAMD, a practical context-driven framework to enable LLM-based Android malware detection. LAMD integrates key context extraction to isolate security-critical code regions and construct program structures, then applies tier-wise code reasoning to analyze application behavior progressively, from low-level instructions to high-level semantics, providing final prediction and explanation. A well-designed factual consistency verification mechanism is equipped to mitigate LLM hallucinations from the first tier. Evaluation in real-world settings demonstrates LAMD's effectiveness over conventional detectors, establishing a feasible basis for LLM-driven malware analysis in dynamic threat landscapes.

Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Builds on 29 of its 68 references that are in the map. First posted on arXiv 18 Feb 2025.

Builds on

29 of 68 references.

References · 29

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,146
  3. 2022Large Language Models are Zero-Shot Reasonerscited by 4,323
  4. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  5. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
  6. 2023Sparks of Artificial General Intelligence: Early experiments with GPT-4cited by 2,579
  7. 2023Can Large Language Models Be an Alternative to Human Evaluations?cited by 729
  8. 2020Asking and Answering Questions to Evaluate the Factual Consistency of Summariescited by 376
  9. 2023Human-like Summarization Evaluation with ChatGPTcited by 126
  10. 2022Automatic Generation of Programming Exercises and Code Explanations using Large Language Modelscited by 124
  11. 2018TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Timecited by 108
  12. 2023LLMs Cannot Reliably Identify and Reason About Security Vulnerabilities (Yet?): A Comprehensive Evaluation, Framework, and Benchmarkscited by 94
17 more
  1. 2024Transformers need glasses! Information over-squashing in language taskscited by 87
  2. 2023Automatic Semantic Augmentation of Language Model Prompts (for Code Summarization)cited by 72
  3. 2024LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs' Vulnerability Reasoningcited by 57
  4. 2020Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Driftcited by 53
  5. 2023Large Language Models for Code Analysis: Do LLMs Really Do Their Job?cited by 44
  6. 2023Continuous Learning for Android Malware Detectioncited by 33
  7. 2015Reviewer Integration and Performance Measurement for Malware Detectioncited by 19
  8. 2024AppPoet: Large Language Model based Android malware detection via multi-view prompt engineeringcited by 16
  9. 2023FINER: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysiscited by 12
  10. 2024RACONTEUR: A Knowledgeable, Insightful, and Portable LLM-Powered Shell Command Explainercited by 9
  11. 2024Transfer Learning in Pre-Trained Large Language Models for Malware Detection Based on System Callscited by 8
  12. 2022Fast & Furious: Modelling Malware Detection as Evolving Data Streamscited by 6
  13. 2024Tactics, Techniques, and Procedures (TTPs) in Interpreted Malware: A Zero-Shot Generation with Large Language Modelscited by 6
  14. 2025Exploring Large Language Models for Semantic Analysis and Categorization of Android Malwarecited by 6
  15. 2022Robust Machine Learning for Malware Detection over Timecited by 5
  16. 2024Unraveling the Key of Machine Learning-based Android Malware Detectioncited by 4
  17. 2025TIF: Learning Temporal Invariance in Android Malware Detectorscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 11; 2026: 7.

18 papers.

Sort:

By area:

  1. 2025Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineeringcited by 15
  2. 2025The Hitchhiker's Guide to Program Analysis, Part II: Deep Thoughts by LLMscited by 4
  3. 2025Benchmarking LLM-Assisted Blue Teaming via Standardized Threat Huntingcited by 4
  4. 2025AppForge: From Assistant to Independent Developer -- Are GPTs Ready for Software Development?cited by 4
  5. 2025Is "Knowing It's Malicious Enough?" Evaluating LLMs for Fine-Grained Malware Behavior Auditingcited by 3
  6. 2025Empirical Evaluation of Concept Drift in ML-Based Android Malware Detectioncited by 2
  7. 2026Identifying Adversary Tactics and Techniques in Malware Binaries with an LLM Agentcited by 2
  8. 2025REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineeringcited by 1
  9. 2026Trident: Improving Malware Detection with LLMs and Behavioral Featurescited by 1
  10. 2025BEACON: Behavioral Malware Classification with Large Language Model Embeddings and Deep Learningcited by 0
  11. 2025XGen-Q: An Explainable Domain-Adaptive LLM Framework with Retrieval-Augmented Generation for Software Securitycited by 0
  12. 2025Retrofit: Continual Learning with Controlled Forgetting for Binary Security Detection and Analysiscited by 0
6 more
  1. 2025LLM-Driven Feature-Level Adversarial Attacks on Android Malware Detectorscited by 0
  2. 2026Challenges and Future Directions in Agentic Reverse Engineering Systemscited by 0
  3. 2026Multi-View Decompilation for LLM-Based Malware Classificationcited by 0
  4. 2026SMETA-ZSL:Semantic Meta-Alignment for Zero-Shot Threat Classificationcited by 0
  5. 2026Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detectioncited by 0
  6. 2026BadQubits: An LLM-Based Framework for Static Pre-Execution Detection of Structurally Harmful Quantum Circuitscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025TraceRAG: A LLM-Based Framework for Explainable Android Malware Detection and Behavior Analysis
  2. 2024Assessing the Effectiveness of LLMs in Android Application Vulnerability Analysis
  3. 2026Evaluating LLMs for Obfuscation Detection and Classification in Android Apps
  4. 2026MARD: A Multi-Agent Framework for Robust Android Malware Detection
  5. 2025Enhancing Android Malware Detection with Retrieval-Augmented Generation
  6. 2026Towards LLM-Enhanced Android Taint Analysis ↗
  7. 2025DroidTTP: Mapping Android Applications with TTP for Cyber Threat Intelligence
  8. 2026Malaika: Understanding Malware through Tri-Grounded Agentic Reasoning