AutoMalDesc: Large-Scale Script Analysis for Cyber Threat Research
Not on the map. Why?
Abstract (arXiv)
Generating thorough natural language explanations for threat detections remains an open problem in cybersecurity research, despite significant advances in automated malware detection systems. In this work, we present AutoMalDesc, an automated static analysis summarization framework that, following initial training on a small set of expert-curated examples, operates independently at scale. This approach leverages an iterative self-paced learning pipeline to progressively enhance output quality through synthetic data generation and validation cycles, eliminating the need for extensive manual data annotation. Evaluation across 3,600 diverse samples in five scripting languages demonstrates statistically significant improvements between iterations, showing consistent gains in both summary quality and classification accuracy. Our comprehensive validation approach combines quantitative metrics based on established malware labels with qualitative assessment from both human experts and LLM-based judges, confirming both technical precision and linguistic coherence of generated summaries. To facilitate reproducibility and advance research in this domain, we publish our complete dataset of more than 100K script samples, including annotated seed (0.9K) and test (3.6K) datasets, along with our methodology and evaluation framework.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 24 of its 43 references that are in the map. First posted on arXiv 17 Nov 2025.
Builds on
24 of 43 references.
References · 24
- 2022Self-Instruct: Aligning Language Models with Self-Generated Instructionscited by 2,724
- 2022Large Language Models Can Self-Improvecited by 664
- 2023Reinforced Self-Training (ReST) for Language Modelingcited by 500
- 2023Software Testing with Large Language Models: Survey, Landscape, and Visioncited by 166
- 2018EMBER: An Open Dataset for Training Static PE Malware Machine Learning Modelscited by 165
- 2024RedCode: Risky Code Execution and Generation Benchmark for Code Agentscited by 90
- 2024Self-Boosting Large Language Models with Synthetic Preference Datacited by 40
- 2023Charting New Territories: Exploring the Geographic and Geospatial Capabilities of Multimodal LLMscited by 34
- 2024I-SHEEP: Self-Alignment of LLM from Scratch through an Iterative Self-Enhancement Paradigmcited by 27
- 2023An Empirical Study of Malicious Code In PyPI Ecosystemcited by 19
- 2025Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineeringcited by 15
- 2023Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performancecited by 13
12 more
- 2025On Benchmarking Code LLMs for Android Malware Analysiscited by 13
- 2023Semi-supervised Classification of Malware Families Under Extreme Class Imbalance via Hierarchical Non-Negative Matrix Factorization with Automatic Model Selectioncited by 9
- 2022Efficient Malware Analysis Using Metric Embeddingscited by 6
- 2023EMBERSim: A Large-Scale Databank for Boosting Similarity Search in Malware Analysiscited by 6
- 2024Feasibility Study for Supporting Static Malware Analysis Using LLMcited by 6
- 2023On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPIcited by 5
- 2024MALSIGHT: Exploring Malicious Source Code and Benign Pseudocode for Iterative Binary Malware Summarizationcited by 5
- 2021Assessing the Effectiveness of YARA Rules for Signature-Based Malware Detection and Classificationcited by 3
- 2024PowerPeeler: A Precise and General Dynamic Deobfuscation Method for PowerShell Scriptscited by 3
- 2024A Machine Learning-Based Approach For Detecting Malicious PyPI Packagescited by 3
- 2024The Pulse of Fileless Cryptojacking Attacks: Malicious PowerShell Scriptscited by 2
- 2024SCORE: Syntactic Code Representations for Static Script Malware Detectioncited by 1
Built on by
Citing papers per year: 2026: 1.
1 paper.