# Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering

**Authors:** Hamed Jelodar, Samita Bai, Parisa Hamedi, Hesamodin Mohammadian, Roozbeh Razavi-Far, Ali Ghorbani  
**arXiv:** [2504.07137](https://arxiv.org/abs/2504.07137)  
**Date:** 2025-04-07  
**Summary page:** https://www.summarizepaper.com/en/paper/2504.07137v1/

## Key points

- Large Language Models (LLMs) are powerful tools in cybersecurity for malware detection, generation, and real-time monitoring.
- LLM-driven models leverage semantic and structural insights to enhance automated threat analysis and pinpoint malicious intent more accurately.
- A customizable framework for dataflow analysis using LLMs was developed to scrutinize Java programs, tested with GPT-3.5, GPT-4, Gemini-1.0, and Claude-3 on real-world Android malware.
- LLM-based approaches integrate external knowledge into language model pre-training phases to enrich understanding and contextual awareness.
- Knowledge-enhanced Pre-trained Language Models (KE-PLMs) can identify relationships associated with malware activities effectively by injecting external knowledge into source code analysis tasks.
- Complete semantic units approach introduced in reference [223] enhances malware code analysis by focusing on long-context understanding and abstract reasoning rather than individual tokens.
- Challenges persist in malware code decompiling due to the size of tokens required for breaking down complex behaviors efficiently.

## Summary

In the realm of cybersecurity, Large Language Models (LLMs) have emerged as powerful tools for malware detection, generation, and real-time monitoring. Recent studies have delved into their application in cybersecurity, showcasing their effectiveness in identifying new malware variants, analyzing malicious code structures, and enhancing automated threat analysis. Various transformer-based architectures and LLM-driven models have been introduced to bolster malware analysis by leveraging semantic and structural insights to pinpoint malicious intent more accurately. One notable study (reference [219]) developed a customizable framework for dataflow analysis using LLMs to scrutinize Java programs. By utilizing the tree-sitter library to extract crucial information like parameters, return values, callers/callees, and sources/sinks, the framework was tested with four LLMs: GPT-3.5, GPT-4, Gemini-1.0, and Claude-3. Its performance was evaluated on real-world Android malware from the TaintBench Suite. Moreover, represent a significant advancement in Natural Language Processing (NLP) by integrating structured external knowledge into language model pre-training phases. These models incorporate various forms of external knowledge such as linguistic information, factual data, and domain-specific insights to enrich the model's understanding and contextual awareness. By injecting external knowledge directly into source code analysis tasks using KE-PLMs, can potentially identify relationships and behaviors associated with malware activities more effectively. Additionally, were introduced in reference [223] to enhance malware code analysis by focusing on complete semantic units rather than individual tokens. This approach allows for improved long-context understanding and abstract reasoning while facilitating more efficient computation for tasks like cross-lingual and multimodal applications. Despite these advancements, challenges persist in malware code decompiling due to the size of tokens required for breaking down complex behaviors into manageable components efficiently. Addressing this challenge is crucial for precise examination of malicious code structures. Overall, this comprehensive review highlights recent advancements in LLM-based approaches in malware code analysis while emphasizing the potential of KE-PLMs and LCMs in enhancing cybersecurity resilience through improved detection mechanisms and understanding of malicious code behaviors.