.png){kind=icon}
.png){kind=icon}
Return
MCLPF: Malware Collaborative Detection With LLM-Enhanced Pruning for Attributed Interpretable Flow Graphs
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2025.3648113.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
With the increasing sophistication of malware, enhanced Attributed Control Flow Graphs (ACFGs) have become a fundamental representation and are widely applied in malware detection. However, existing CFG-based detection techniques primarily extract shallow features of malware, neglecting deeper structural and semantic characteristics. Additionally, retaining all basic blocks in CFGs significantly increases the memory overhead of detection models. To address these issues, we propose MCLPF, collaborative malware detection with interpretable pruning, to improve the overall performance of existing malware detection systems that rely on fine-grained control flow features. MCLPF first introduces a novel Attributed Interpretable Flow Graph (AIFG) to extract functional attributes, integrating node-level features, edge-level features, and assembly language embedding features derived from Large Language Models (LLMs). Subsequently, it proposes an efficient and reliable detection scheme by alternately updating the graph structure and language learning modules through L-Step and G-Step, rather than synchronously training Language Models (LMs) with Graph Neural Networks (GNNs) on large-scale graphs. We conduct experiments using public datasets involving four different architectures (i.e., PE-32, PE-64, ELF-32, and ELF-64) and demonstrate that our model achieves an exceptionally high detection accuracy (i.e., 99.30%). After pruning 100% of noncritical nodes and edges, the sample size is reduced to approximately 8% of the original, with an average time cost reduction of 74.7%, while the detection performance fluctuation averages only about 1%. Extensive cross-dataset evaluations validate the effectiveness and efficiency of the proposed method.
Keywords:
Malware detection
large language models
attributed interpretable flow graph
joint training
interpretable pruning
Journal
IF:
8
Papers:
5.2K
Citations:
2.3W