# Is "Knowing It's Malicious Enough?" Evaluating LLMs for Fine-Grained Malware Behavior Auditing

arXiv: https://arxiv.org/abs/2509.14335 · HTML: https://mlsanity.com/paper/2509.14335/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 56 references that are in the map.
- First posted on arXiv 17 Sep 2025.

## Builds on (most cited first, 25 of 25)

- [Qwen3 Technical Report](https://mlsanity.com/paper/2505.09388/) (2025)
- [Evaluating Large Language Models Trained on Code](https://mlsanity.com/paper/2107.03374/) (2021)
- [Efficient Memory Management for Large Language Model Serving with PagedAttention](https://mlsanity.com/paper/2309.06180/) (2023)
- [BERTScore: Evaluating Text Generation with BERT](https://mlsanity.com/paper/1904.09675/) (2019)
- [Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities](https://mlsanity.com/paper/2507.06261/) (2025)
- [Qwen2.5-Coder Technical Report](https://mlsanity.com/paper/2409.12186/) (2024)
- [CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding and Generation](https://mlsanity.com/paper/2102.04664/) (2021)
- [Large Language Models for Software Engineering: A Systematic Literature Review](https://mlsanity.com/paper/2308.10620/) (2023)
- [Large Language Models for Code: Security Hardening and Adversarial Testing](https://mlsanity.com/paper/2302.05319/) (2023)
- [Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift](https://mlsanity.com/paper/2010.03856/) (2020)
- [Reasoning Runtime Behavior of a Program with LLM: How Far Are We?](https://mlsanity.com/paper/2403.16437/) (2024)
- [CoRe: Benchmarking LLMs Code Reasoning Capabilities through Static Analysis Tasks](https://mlsanity.com/paper/2507.05269/) (2025)
- [LLMDFA: Analyzing Dataflow in Code with Large Language Models](https://mlsanity.com/paper/2402.10754/) (2024)
- [LAMD: Context-driven Android Malware Detection and Classification with LLMs](https://mlsanity.com/paper/2502.13055/) (2025)
- [A.S.E: A Repository-Level Benchmark for Evaluating Security in AI-Generated Code](https://mlsanity.com/paper/2508.18106/) (2025)
- [On Benchmarking Code LLMs for Android Malware Analysis](https://mlsanity.com/paper/2504.00694/) (2025)
- [CodeSense: a Real-World Benchmark and Dataset for Code Semantic Reasoning](https://mlsanity.com/paper/2506.00750/) (2025)
- [FINER: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysis](https://mlsanity.com/paper/2308.05362/) (2023)
- [Automated Behavioral Analysis of Malware A Case Study of WannaCry Ransomware](https://mlsanity.com/paper/1709.08753/) (2017)
- [Combating Concept Drift with Explanatory Detection and Adaptation for Android Malware Classification](https://mlsanity.com/paper/2405.04095/) (2024)
- [Exploring Large Language Models for Semantic Analysis and Categorization of Android Malware](https://mlsanity.com/paper/2501.04848/) (2025)
- [The Code Barrier: What LLMs Actually Understand?](https://mlsanity.com/paper/2504.10557/) (2025)
- [Enhancing Android Malware Detection: The Influence of ChatGPT on Decision-centric Task](https://mlsanity.com/paper/2410.04352/) (2024)
- [TraceRAG: A LLM-Based Framework for Explainable Android Malware Detection and Behavior Analysis](https://mlsanity.com/paper/2509.08865/) (2025)
- [MalLoc: Toward Fine-grained Android Malicious Payload Localization via LLMs](https://mlsanity.com/paper/2508.17856/) (2025)

## Built on by (most cited first, 3 of 3)

- [Identifying Adversary Tactics and Techniques in Malware Binaries with an LLM Agent](https://mlsanity.com/paper/2602.06325/) (2026)
- [Malaika: Understanding Malware through Tri-Grounded Agentic Reasoning](https://mlsanity.com/paper/2607.09179/) (2026)
- [SCRIPTIOC-BENCH: A Benchmark for Recognizing Actionable Threat Intelligence from Script-Based Malware using LLMs](https://mlsanity.com/paper/2609.06149/) (2026)

## Abstract (arXiv)

Automated malware classifiers achieve strong detection performance, but auditing requires more than flagging a sample: analysts must explain malicious behaviors and justify them with code evidence. Traditional signature-based methods and learning-based XAI often fail to provide such support in a human-interpretable form. Large Language Models (LLMs) appear promising, yet their reliability for malware auditing remains unclear. Evaluation faces three challenges: (1) the lack of human-written behavioral ground truth; (2) real-world codebases that exceed current context limits; and (3) the lack of reliable mechanisms to verify whether generated claims are grounded in code evidence. These obstacles make benchmarking difficult and leave model capabilities and failure modes opaque. We introduce MalEval, a diagnostic framework for measuring the capability boundaries of LLMs in malware auditing. MalEval pairs real-world application codebases with expert-written audit reports to provide fine-grained behavior-level ground truth. It compresses large codebases into behavior-relevant program contexts through a context-driven intermediate representation that preserves call relations. Expert reports and model outputs are mapped, via constrained reasoning, into structured evidence chains linking code-level facts to high-level behaviors in a shared space. MalEval decomposes auditing into four stage-wise tasks, enabling each intermediate judgment to be verified under limited context windows. We evaluate seven LLMs and find that they rely on surface cues rather than verifiable evidence, struggle to compose dispersed facts into coherent attack chains, and are highly sensitive to context formulation. These findings shift attention from isolated outputs to reliable LLM and agentic workflows for malware auditing. MalEval is publicly available at https://github.com/ZhengXR930/MalEval.git