mlsanityData to 14 Oct 2026

LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution

arXiv 2605.05807 ↗First posted 7 May 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

LLMs are increasingly explored for malware analysis; however, current LLM-based malware attribution remains limited by unsupported indicators and insufficient code-level grounding for identifying malicious and vulnerable code segments. To address these limitations, this research introduces LCC-LLM, a code-centric benchmark dataset and evidence-grounded framework for malware attribution and multi-task static malware analysis. The proposed LCCD dataset contains approximately 34K PE samples processed through a large-scale reverse-engineering pipeline and represented using decompiled C code, assembly code, CFG/FCG artifacts, hexadecimal data, PE metadata, suspicious API evidence, and structural features. Beyond dataset construction, LCC-LLM integrates LangGraph-orchestrated static analysis with multi-source cybersecurity knowledge to support evidence-grounded malware reasoning. The framework employs a seven-layer retrieval-augmented generation pipeline, CoVe for IoC validation, and a multi-dimensional quality gate to improve factual reliability and analyst-oriented decision support. Curriculum-ordered instruction data is used to fine-tune DeepSeek-R1-Distill-Qwen-14B and Qwen3-Coder-30B-A3B using QLoRA. Evaluation across 43 malware-analysis task types achieves an average semantic similarity of 0.634, with the highest task-level performance in structured report generation, IoC extraction, vulnerability assessment, malware configuration extraction, and malware class detection. In a real-world case study using MalwareBazaar samples, the grounded pipeline achieves a 10/10 structured analysis pass rate, producing CFG/FCG evidence, MITRE ATT&CK mappings, detection guidance, and analyst-ready reports. These results show that code-centric representations, retrieval grounding, and verification-guided reasoning improve the reliability and operational usefulness of LLM-assisted malware attribution.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 24 of its 58 references that are in the map. First posted on arXiv 7 May 2026.

Builds on

24 of 58 references.

References · 24

  1. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
  2. 2023DINOv2: Learning Robust Visual Features without Supervisioncited by 7,974
  3. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  4. 2016node2vec: Scalable Feature Learning for Networkscited by 1,918
  5. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  6. 2023CodeT5+: Open Code Large Language Models for Code Understanding and Generationcited by 333
  7. 2023Chain-of-Verification Reduces Hallucination in Large Language Modelscited by 324
  8. 2023SemDeDup: Data-efficient learning at web-scale through semantic deduplicationcited by 303
  9. 2018EMBER: An Open Dataset for Training Static PE Malware Machine Learning Modelscited by 165
  10. 2024Vulnerability Detection with Code Language Models: How Far Are We?cited by 139
  11. 2017Malware Detection by Eating a Whole EXEcited by 115
  12. 2020SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detectioncited by 49
12 more
  1. 2018Microsoft Malware Classification Challengecited by 46
  2. 2023An Empirical Study of Malicious Code In PyPI Ecosystemcited by 19
  3. 2021Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Artcited by 18
  4. 2025Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineeringcited by 15
  5. 2022Graph Neural Network-based Android Malware Classification with Jumping Knowledgecited by 9
  6. 2022Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learningcited by 6
  7. 2024Explainable Malware Detection through Integrated Graph Reduction and Learning Techniquescited by 5
  8. 2025"Digital Camouflage": The LLVM Challenge in LLM-Based Malware Detectioncited by 5
  9. 2025Semantic Preprocessing for LLM-based Malware Analysiscited by 3
  10. 2025TraceRAG: A LLM-Based Framework for Explainable Android Malware Detection and Behavior Analysiscited by 3
  11. 2025SBAN: A Framework & Multi-Dimensional Dataset for Large Language Model Pre-Training and Software Code Miningcited by 3
  12. 2026Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Modelscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Is "Knowing It's Malicious Enough?" Evaluating LLMs for Fine-Grained Malware Behavior Auditing
  2. 2026AsmRAG: LLM-Driven Malware Detection by Retrieving Functionally Similar Assembly Code
  3. 2025MalCVE: Malware Detection and CVE Association Using Large Language Models
  4. 2025Analysing Safety Risks in LLMs Fine-Tuned with Pseudo-Malicious Cyber Security Data
  5. 2025XGen-Q: An Explainable Domain-Adaptive LLM Framework with Retrieval-Augmented Generation for Software Security
  6. 2026An Empirical Evaluation of LLM-Based Approaches for Code Vulnerability Detection: RAG, SFT, and Dual-Agent Systems
  7. 2025LLM Embedding-based Attribution (LEA): Quantifying Source Contributions to Generative Model's Response for Vulnerability Analysis
  8. 2025MGC: A Compiler Framework Exploiting Compositional Blindness in Aligned LLMs for Malware Generation