Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering
Not on the map. Why?
Abstract (arXiv)
Large Language Models (LLMs) have recently emerged as powerful tools in cybersecurity, offering advanced capabilities in malware detection, generation, and real-time monitoring. Numerous studies have explored their application in cybersecurity, demonstrating their effectiveness in identifying novel malware variants, analyzing malicious code structures, and enhancing automated threat analysis. Several transformer-based architectures and LLM-driven models have been proposed to improve malware analysis, leveraging semantic and structural insights to recognize malicious intent more accurately. This study presents a comprehensive review of LLM-based approaches in malware code analysis, summarizing recent advancements, trends, and methodologies. We examine notable scholarly works to map the research landscape, identify key challenges, and highlight emerging innovations in LLM-driven cybersecurity. Additionally, we emphasize the role of static analysis in malware detection, introduce notable datasets and specialized LLM models, and discuss essential datasets supporting automated malware research. This study serves as a valuable resource for researchers and cybersecurity professionals, offering insights into LLM-powered malware detection and defence strategies while outlining future directions for strengthening cybersecurity resilience.
Key facts. Cited by 15 papers in the map (data through 14 Oct 2026). Builds on 81 of its 208 references that are in the map. First posted on arXiv 7 Apr 2025.
Builds on
81 of 208 references.
References · 81
- 2017Attention Is All You Needcited by 60,361
- 2024Mixtral of Expertscited by 1,823
- 2024DeepSeek-Coder: When the Large Language Model Meets Programming -- The Rise of Code Intelligencecited by 1,181
- 2023WizardCoder: Empowering Code Large Language Models with Evol-Instructcited by 733
- 2024DeepSeek LLM: Scaling Open-Source Language Models with Longtermismcited by 642
- 2023A Prompt Pattern Catalog to Enhance Prompt Engineering with ChatGPTcited by 619
- 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 498
- 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 489
- 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
- 2024A Systematic Survey of Prompt Engineering in Large Language Models: Techniques and Applicationscited by 431
- 2023Large Language Models for Software Engineering: A Systematic Literature Reviewcited by 399
- 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
38 more
- 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 333
- 2023CodeT5+: Open Code Large Language Models for Code Understanding and Generationcited by 333
- 2023A Comprehensive Capability Analysis of GPT-3 and GPT-3.5 Series Modelscited by 246
- 2023Software Testing with Large Language Models: Survey, Landscape, and Visioncited by 166
- 2018EMBER: An Open Dataset for Training Static PE Malware Machine Learning Modelscited by 165
- 2023From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacycited by 143
- 2017Dataset Augmentation in Feature Spacecited by 124
- 2024IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilitiescited by 103
- 2024AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attackscited by 96
- 2021CVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Softwarecited by 91
- 2024Large Concept Models: Language Modeling in a Sentence Representation Spacecited by 89
- 2022A Survey of Knowledge Enhanced Pre-trained Language Modelscited by 76
- 2020SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detectioncited by 49
- 2018Microsoft Malware Classification Challengecited by 46
- 2024Finetuning Large Language Models for Vulnerability Detectioncited by 40
- 2022Transformer-Based Language Models for Software Vulnerability Detectioncited by 39
- 2024Malla: Demystifying Real-world Large Language Model Integrated Malicious Servicescited by 33
- 2023From Text to MITRE Techniques: Exploring the Malicious Use of Large Language Models for Generating Cyber Attack Payloadscited by 32
- 2019A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Softwarecited by 28
- 2024RMCBench: Benchmarking Large Language Models' Resistance to Malicious Codecited by 28
- 2023How Far Have We Gone in Vulnerability Detection Using Large Language Modelscited by 27
- 2024Measure-Observe-Remeasure: An Interactive Paradigm for Differentially-Private Exploratory Analysiscited by 24
- 2023Decoding the Threat Landscape : ChatGPT, FraudGPT, and WormGPT in Social Engineering Attackscited by 23
- 2024LLMDFA: Analyzing Dataflow in Code with Large Language Modelscited by 22
- 2024LLMs in Web Development: Evaluating LLM-Generated PHP Code Unveiling Vulnerabilities and Limitationscited by 22
- 2024AI-powered Code Review with LLMs: Early Resultscited by 22
- 2023Leveraging Large Language Models to Improve REST API Testingcited by 20
- 2024Analyzing the Performance of Large Language Models on Code Summarizationcited by 19
- 2024Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaignscited by 19
- 2024Can We Trust Large Language Models Generated Code? A Framework for In-Context Learning, Security Patterns, and Code Evaluations Across Diverse LLMscited by 19
- 2023RatGPT: Turning online LLMs into Proxies for Malware Attackscited by 18
- 2025LAMD: Context-driven Android Malware Detection and Classification with LLMscited by 18
- 2020Why an Android App is Classified as Malware? Towards Malware Classification Interpretationcited by 16
- 2023Generating Phishing Attacks using ChatGPTcited by 16
- 2023DeTiME: Diffusion-Enhanced Topic Modeling using Encoder-decoder based LLMcited by 16
- 2024AppPoet: Large Language Model based Android malware detection via multi-view prompt engineeringcited by 16
- 2023Can Large Language Models Find And Fix Vulnerable Software?cited by 15
- 2022Automated Test Generation for REST APIs: No Time to Rest Yetcited by 13
50 most cited of 81 All 81 (JSON)
Built on by
Citing papers per year: 2025: 9; 2026: 6.
15 papers.
Sort:
By area:
- 2025Weakest Link in the Chain: Security Vulnerabilities in Advanced Reasoning Modelscited by 7
- 2025REFINE: Enhancing Program Repair Agents through Context-Aware Patch Refinementcited by 6
- 2025AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMscited by 4
- 2025The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelinescited by 2
- 2025AutoMalDesc: Large-Scale Script Analysis for Cyber Threat Researchcited by 1
- 2026Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Modelscited by 1
- 2026ConVer: Using Contracts and Loop Invariant Synthesis for Scalable Formal Software Verificationcited by 1
- 2025Every Character Counts: From Vulnerability to Defense in Phishing Detectioncited by 0
- 2025XGen-Q: An Explainable Domain-Adaptive LLM Framework with Retrieval-Augmented Generation for Software Securitycited by 0
- 2025FlexiDataGen: An Adaptive LLM Framework for Dynamic Semantic Dataset Generation in Sensitive Domainscited by 0
- 2025Asm2SrcEval: Evaluating Large Language Models for Assembly-to-Source Code Translationcited by 0
- 2026LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attributioncited by 0
3 more
- 2026Security Document Classification with a Fine-Tuned Local Large Language Model: Benchmark Data and an Open-Source Systemcited by 0
- 2026ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzerscited by 0
- 2026Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysiscited by 0
- 2026Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysis21 Sep 2026
- 2026ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers17 Sep 2026
- 2026ConVer: Using Contracts and Loop Invariant Synthesis for Scalable Formal Software Verification26 May 2026
- 2026Security Document Classification with a Fine-Tuned Local Large Language Model: Benchmark Data and an Open-Source System19 May 2026
- 2026LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution7 May 2026
- 2026Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models2 Apr 2026
- 2025The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines7 Dec 2025
- 2025Asm2SrcEval: Evaluating Large Language Models for Assembly-to-Source Code Translation28 Nov 2025
- 2025AutoMalDesc: Large-Scale Script Analysis for Cyber Threat Research17 Nov 2025
- 2025FlexiDataGen: An Adaptive LLM Framework for Dynamic Semantic Dataset Generation in Sensitive Domains21 Oct 2025
- 2025XGen-Q: An Explainable Domain-Adaptive LLM Framework with Retrieval-Augmented Generation for Software Security21 Oct 2025
- 2025REFINE: Enhancing Program Repair Agents through Context-Aware Patch Refinement4 Oct 2025
- 2025AutoMalDesc: Large-Scale Script Analysis for Cyber Threat Researchcited by 1
- 2026Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Modelscited by 1
- 2026ConVer: Using Contracts and Loop Invariant Synthesis for Scalable Formal Software Verificationcited by 1
- 2025Every Character Counts: From Vulnerability to Defense in Phishing Detectioncited by 0
- 2025FlexiDataGen: An Adaptive LLM Framework for Dynamic Semantic Dataset Generation in Sensitive Domainscited by 0
- 2025Asm2SrcEval: Evaluating Large Language Models for Assembly-to-Source Code Translationcited by 0
- 2026LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attributioncited by 0
- 2026Security Document Classification with a Fine-Tuned Local Large Language Model: Benchmark Data and an Open-Source Systemcited by 0
- 2026ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzerscited by 0
- 2026ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers17 Sep 2026
- 2026ConVer: Using Contracts and Loop Invariant Synthesis for Scalable Formal Software Verification26 May 2026
- 2026Security Document Classification with a Fine-Tuned Local Large Language Model: Benchmark Data and an Open-Source System19 May 2026
- 2026LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution7 May 2026
- 2026Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models2 Apr 2026
- 2025Asm2SrcEval: Evaluating Large Language Models for Assembly-to-Source Code Translation28 Nov 2025
- 2025AutoMalDesc: Large-Scale Script Analysis for Cyber Threat Research17 Nov 2025
- 2025FlexiDataGen: An Adaptive LLM Framework for Dynamic Semantic Dataset Generation in Sensitive Domains21 Oct 2025
- 2025Every Character Counts: From Vulnerability to Defense in Phishing Detection24 Sep 2025