# AutoMalDesc: Large-Scale Script Analysis for Cyber Threat Research

arXiv: https://arxiv.org/abs/2511.13333 · HTML: https://mlsanity.com/paper/2511.13333/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 43 references that are in the map.
- First posted on arXiv 17 Nov 2025.

## Builds on (most cited first, 24 of 24)

- [Self-Instruct: Aligning Language Models with Self-Generated Instructions](https://mlsanity.com/paper/2212.10560/) (2022)
- [Large Language Models Can Self-Improve](https://mlsanity.com/paper/2210.11610/) (2022)
- [Reinforced Self-Training (ReST) for Language Modeling](https://mlsanity.com/paper/2308.08998/) (2023)
- [Software Testing with Large Language Models: Survey, Landscape, and Vision](https://mlsanity.com/paper/2307.07221/) (2023)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [RedCode: Risky Code Execution and Generation Benchmark for Code Agents](https://mlsanity.com/paper/2411.07781/) (2024)
- [Self-Boosting Large Language Models with Synthetic Preference Data](https://mlsanity.com/paper/2410.06961/) (2024)
- [Charting New Territories: Exploring the Geographic and Geospatial Capabilities of Multimodal LLMs](https://mlsanity.com/paper/2311.14656/) (2023)
- [I-SHEEP: Self-Alignment of LLM from Scratch through an Iterative Self-Enhancement Paradigm](https://mlsanity.com/paper/2408.08072/) (2024)
- [An Empirical Study of Malicious Code In PyPI Ecosystem](https://mlsanity.com/paper/2309.11021/) (2023)
- [Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering](https://mlsanity.com/paper/2504.07137/) (2025)
- [Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance](https://mlsanity.com/paper/2307.14657/) (2023)
- [On Benchmarking Code LLMs for Android Malware Analysis](https://mlsanity.com/paper/2504.00694/) (2025)
- [Semi-supervised Classification of Malware Families Under Extreme Class Imbalance via Hierarchical Non-Negative Matrix Factorization with Automatic Model Selection](https://mlsanity.com/paper/2309.06643/) (2023)
- [Efficient Malware Analysis Using Metric Embeddings](https://mlsanity.com/paper/2212.02663/) (2022)
- [EMBERSim: A Large-Scale Databank for Boosting Similarity Search in Malware Analysis](https://mlsanity.com/paper/2310.01835/) (2023)
- [Feasibility Study for Supporting Static Malware Analysis Using LLM](https://mlsanity.com/paper/2411.14905/) (2024)
- [On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI](https://mlsanity.com/paper/2310.09571/) (2023)
- [MALSIGHT: Exploring Malicious Source Code and Benign Pseudocode for Iterative Binary Malware Summarization](https://mlsanity.com/paper/2406.18379/) (2024)
- [Assessing the Effectiveness of YARA Rules for Signature-Based Malware Detection and Classification](https://mlsanity.com/paper/2111.13910/) (2021)
- [PowerPeeler: A Precise and General Dynamic Deobfuscation Method for PowerShell Scripts](https://mlsanity.com/paper/2406.04027/) (2024)
- [A Machine Learning-Based Approach For Detecting Malicious PyPI Packages](https://mlsanity.com/paper/2412.05259/) (2024)
- [The Pulse of Fileless Cryptojacking Attacks: Malicious PowerShell Scripts](https://mlsanity.com/paper/2401.07995/) (2024)
- [SCORE: Syntactic Code Representations for Static Script Malware Detection](https://mlsanity.com/paper/2411.08182/) (2024)

## Built on by (most cited first, 1 of 1)

- [AI-Generated PowerShell Malware: An Experimental Framework and Dataset](https://mlsanity.com/paper/2606.30819/) (2026)

## Abstract (arXiv)

Generating thorough natural language explanations for threat detections remains an open problem in cybersecurity research, despite significant advances in automated malware detection systems. In this work, we present AutoMalDesc, an automated static analysis summarization framework that, following initial training on a small set of expert-curated examples, operates independently at scale. This approach leverages an iterative self-paced learning pipeline to progressively enhance output quality through synthetic data generation and validation cycles, eliminating the need for extensive manual data annotation. Evaluation across 3,600 diverse samples in five scripting languages demonstrates statistically significant improvements between iterations, showing consistent gains in both summary quality and classification accuracy. Our comprehensive validation approach combines quantitative metrics based on established malware labels with qualitative assessment from both human experts and LLM-based judges, confirming both technical precision and linguistic coherence of generated summaries. To facilitate reproducibility and advance research in this domain, we publish our complete dataset of more than 100K script samples, including annotated seed (0.9K) and test (3.6K) datasets, along with our methodology and evaluation framework.