# Trident: Improving Malware Detection with LLMs and Behavioral Features

arXiv: https://arxiv.org/abs/2605.00297 · HTML: https://mlsanity.com/paper/2605.00297/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 65 references that are in the map.
- First posted on arXiv 30 Apr 2026.

## Builds on (most cited first, 25 of 25)

- [Generalized Out-of-Distribution Detection: A Survey](https://mlsanity.com/paper/2110.11334/) (2021)
- [Learning under Concept Drift: A Review](https://mlsanity.com/paper/2004.05785/) (2020)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [jina-embeddings-v3: Multilingual Embeddings With Task LoRA](https://mlsanity.com/paper/2409.10173/) (2024)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detection](https://mlsanity.com/paper/2012.07634/) (2020)
- [A Survey of Machine Learning Methods and Challenges for Windows Malware Classification](https://mlsanity.com/paper/2006.09271/) (2020)
- [Continuous Learning for Android Malware Detection](https://mlsanity.com/paper/2302.04332/) (2023)
- [Dynamic Malware Analysis with Feature Engineering and Feature Learning](https://mlsanity.com/paper/1907.07352/) (2019)
- [EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers](https://mlsanity.com/paper/2506.05074/) (2025)
- [LAMD: Context-driven Android Malware Detection and Classification with LLMs](https://mlsanity.com/paper/2502.13055/) (2025)
- [Automatic Yara Rule Generation Using Biclustering](https://mlsanity.com/paper/2009.03779/) (2020)
- [AppPoet: Large Language Model based Android malware detection via multi-view prompt engineering](https://mlsanity.com/paper/2404.18816/) (2024)
- [Neurlux: Dynamic Malware Analysis Without Feature Engineering](https://mlsanity.com/paper/1910.11376/) (2019)
- [MalBERT: Using Transformers for Cybersecurity and Malicious Software Detection](https://mlsanity.com/paper/2103.03806/) (2021)
- [Revisiting Concept Drift in Windows Malware Detection: Adaptation to Real Drifted Malware with Minimal Samples](https://mlsanity.com/paper/2407.13918/) (2024)
- [Quo Vadis: Hybrid Machine Learning Meta-Model based on Contextual and Behavioral Malware Representations](https://mlsanity.com/paper/2208.12248/) (2022)
- [Nebula: Self-Attention for Dynamic Malware Analysis](https://mlsanity.com/paper/2310.10664/) (2023)
- [DRMD: Deep Reinforcement Learning for Malware Detection under Concept Drift](https://mlsanity.com/paper/2508.18839/) (2025)
- [Automated Machine Learning for Deep Learning based Malware Detection](https://mlsanity.com/paper/2303.01679/) (2023)
- [MaLAware: Automating the Comprehension of Malicious Software Behaviours using Large Language Models (LLMs)](https://mlsanity.com/paper/2504.01145/) (2025)
- [Portable, Data-Driven Malware Detection using Language Processing and Machine Learning Techniques on Behavioral Analysis Reports](https://mlsanity.com/paper/1812.10327/) (2018)
- [TraceRAG: A LLM-Based Framework for Explainable Android Malware Detection and Behavior Analysis](https://mlsanity.com/paper/2509.08865/) (2025)
- [ML-Based Behavioral Malware Detection Is Far From a Solved Problem](https://mlsanity.com/paper/2405.06124/) (2024)
- [MalCVE: Malware Detection and CVE Association Using Large Language Models](https://mlsanity.com/paper/2510.15567/) (2025)

## Built on by (most cited first, 1 of 1)

- [Malaika: Understanding Malware through Tri-Grounded Agentic Reasoning](https://mlsanity.com/paper/2607.09179/) (2026)

## Abstract (arXiv)

Traditionally, machine learning methods for PE malware detection have relied on static features like byte histograms, string information, and PE header contents. One barrier to incorporating dynamic analysis features has been the semi-structured nature of sandbox behavior reports. We show that, using the latest generation of large language models with reasoning, it is possible to efficiently process these behavior reports and utilize them as part of a malware detection pipeline. Specifically, we leverage LLMs to generate behavior-based malware detection rules based on a small training set of labeled malware. We find that these detection rules, derived from behavioral features, are much more robust to concept drift than standard static-feature methods, while maintaining practical false positive rates. Finally, we introduce Trident, a system which combines a classic decision tree model over static features, our behavior-based detection rules, and direct LLM analysis of sandbox reports through majority voting. Trident outperforms standard methods using static features, outperforms behavior-based rules alone, and is as resilient to concept drift as active learning methods without requiring retraining.