# Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models

arXiv: https://arxiv.org/abs/2604.02490 · HTML: https://mlsanity.com/paper/2604.02490/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 27 of its 53 references that are in the map.
- First posted on arXiv 2 Apr 2026.

## Builds on (most cited first, 27 of 27)

- [Large Language Models are Zero-Shot Reasoners](https://mlsanity.com/paper/2205.11916/) (2022)
- [Qwen2.5-Coder Technical Report](https://mlsanity.com/paper/2409.12186/) (2024)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [When LLMs Meet Cybersecurity: A Systematic Literature Review](https://mlsanity.com/paper/2405.03644/) (2024)
- [SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detection](https://mlsanity.com/paper/2012.07634/) (2020)
- [Deep Neural Network Based Malware Detection Using Two Dimensional Binary Program Features](https://mlsanity.com/paper/1508.03096/) (2015)
- [Large Language Models for Code Analysis: Do LLMs Really Do Their Job?](https://mlsanity.com/paper/2310.12357/) (2023)
- [GPT-3.5, GPT-4, or BARD? Evaluating LLMs Reasoning Ability in Zero-Shot Setting and Performance Boosting Through Prompts](https://mlsanity.com/paper/2305.12477/) (2023)
- [Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification](https://mlsanity.com/paper/1511.04317/) (2015)
- [AVClass2: Massive Malware Tag Extraction from AV Labels](https://mlsanity.com/paper/2006.10615/) (2020)
- [Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaigns](https://mlsanity.com/paper/2404.19715/) (2024)
- [EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers](https://mlsanity.com/paper/2506.05074/) (2025)
- [Large Language Models (LLMs) for Source Code Analysis: applications, models and datasets](https://mlsanity.com/paper/2503.17502/) (2025)
- [Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering](https://mlsanity.com/paper/2504.07137/) (2025)
- [On Benchmarking Code LLMs for Android Malware Analysis](https://mlsanity.com/paper/2504.00694/) (2025)
- [MalNet: A Large-Scale Image Database of Malicious Software](https://mlsanity.com/paper/2102.01072/) (2021)
- [ClarAVy: A Tool for Scalable and Accurate Malware Family Labeling](https://mlsanity.com/paper/2502.02759/) (2025)
- [A Survey of Malware Detection Using Deep Learning](https://mlsanity.com/paper/2407.19153/) (2024)
- [Recent Advances in Malware Detection: Graph Learning and Explainability](https://mlsanity.com/paper/2502.10556/) (2025)
- [Assessing the Impact of Packing on Machine Learning-Based Malware Detection and Classification Systems](https://mlsanity.com/paper/2410.24017/) (2024)
- [MalDICT: Benchmark Datasets on Malware Behaviors, Platforms, Exploitation, and Packers](https://mlsanity.com/paper/2310.11706/) (2023)
- [Machine Learning Aided Static Malware Analysis: A Survey and Tutorial](https://mlsanity.com/paper/1808.01201/) (2018)
- [A Comprehensive Study on Learning-Based PE Malware Family Classification Methods](https://mlsanity.com/paper/2110.15552/) (2021)
- [A Comparison of Graph Neural Networks for Malware Classification](https://mlsanity.com/paper/2303.12812/) (2023)
- [Ensembling Large Language Models for Code Vulnerability Detection: An Empirical Evaluation](https://mlsanity.com/paper/2509.12629/) (2025)
- [Majority Rules: LLM Ensemble is a Winning Approach for Content Categorization](https://mlsanity.com/paper/2511.15714/) (2025)

## Built on by (most cited first, 1 of 1)

- [LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution](https://mlsanity.com/paper/2605.05807/) (2026)

## Abstract (arXiv)

Malware family classification remains a challenging task in automated malware analysis, particularly in real-world settings characterized by obfuscation, packing, and rapidly evolving threats. Existing machine learning and deep learning approaches typically depend on labeled datasets, handcrafted features, supervised training, or dynamic analysis, which limits their scalability and effectiveness in open-world scenarios. This paper presents a zero-label malware family classification framework based on a weighted hierarchical ensemble of pretrained large language models (LLMs). Rather than relying on feature-level learning or model retraining, the proposed approach aggregates decision-level predictions from multiple LLMs with complementary reasoning strengths. Model outputs are weighted using empirically derived macro-F1 scores and organized hierarchically, first resolving coarse-grained malicious behavior before assigning fine-grained malware families. This structure enhances robustness, reduces individual model instability, and aligns with analyst-style reasoning.