# Semantic Preprocessing for LLM-based Malware Analysis

arXiv: https://arxiv.org/abs/2506.12113 · HTML: https://mlsanity.com/paper/2506.12113/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 33 references that are in the map.
- First posted on arXiv 13 Jun 2025.

## Builds on (most cited first, 15 of 15)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [CodeT5+: Open Code Large Language Models for Code Understanding and Generation](https://mlsanity.com/paper/2305.07922/) (2023)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning](https://mlsanity.com/paper/1801.08917/) (2018)
- [SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detection](https://mlsanity.com/paper/2012.07634/) (2020)
- [Microsoft Malware Classification Challenge](https://mlsanity.com/paper/1802.10135/) (2018)
- [EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers](https://mlsanity.com/paper/2506.05074/) (2025)
- [MERLIN -- Malware Evasion with Reinforcement LearnINg](https://mlsanity.com/paper/2203.12980/) (2022)
- [AI-based Malware and Ransomware Detection Models](https://mlsanity.com/paper/2207.02108/) (2022)
- [Towards an Automated Pipeline for Detecting and Classifying Malware through Machine Learning](https://mlsanity.com/paper/2106.05625/) (2021)
- [MalDICT: Benchmark Datasets on Malware Behaviors, Platforms, Exploitation, and Packers](https://mlsanity.com/paper/2310.11706/) (2023)
- [Image-Based Malware Classification Using QR and Aztec Codes](https://mlsanity.com/paper/2412.08514/) (2024)
- [Use of Multi-CNNs for Section Analysis in Static Malware Detection](https://mlsanity.com/paper/2402.04102/) (2024)

## Built on by (most cited first, 3 of 3)

- [BEACON: Behavioral Malware Classification with Large Language Model Embeddings and Deep Learning](https://mlsanity.com/paper/2509.14519/) (2025)
- [LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution](https://mlsanity.com/paper/2605.05807/) (2026)
- [ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers](https://mlsanity.com/paper/2609.19722/) (2026)

## Abstract (arXiv)

In a context of malware analysis, numerous approaches rely on Artificial Intelligence to handle a large volume of data. However, these techniques focus on data view (images, sequences) and not on an expert's view. Noticing this issue, we propose a preprocessing that focuses on expert knowledge to improve malware semantic analysis and result interpretability. We propose a new preprocessing method which creates JSON reports for Portable Executable files. These reports gather features from both static and behavioral analysis, and incorporate packer signature detection, MITRE ATT&CK and Malware Behavior Catalog (MBC) knowledge. The purpose of this preprocessing is to gather a semantic representation of binary files, understandable by malware analysts, and that can enhance AI models' explainability for malicious files analysis. Using this preprocessing to train a Large Language Model for Malware classification, we achieve a weighted-average F1-score of 0.94 on a complex dataset, representative of market reality.