Skip to content
Conference

LLM Based Static Malware Analysis for Windows Portable Executables

Jul 2026 · International Conference on Computer Communications and Networks · pp. 1-6 · 0 citations · 25 references

Abstract

In this work we introduce a novel application of Large Language Models (LLMs) towards the classification of malicious Windows Portable Executable (WinPE) files. Rather than fine-tuning an LLM based on the raw binary of the samples serving as the corpus, in this case we leverage our in depth knowledge of the underlying structure of the WinPE format to apply a two phased approach to translate each file into human readable format. For our studies we focus on the header portion of the files in order to reduce the required time for the fine-tuning process, performing Parameter Efficient Fine Tuning (PEFT) applying a QLoRA adapter to a light-weight baseline model. In addition, we deploy our fine-tuned model according to Software Defined Networking (SDN) principles. The model is containerized, with constraints applied in terms of the amount of CPU, memory, and networking resources that are available. In addition, the model is deployed as a virtualized LLM (vLLM) adhering to a server-client architecture. We benchmark the fine-tuned model against the SoReL-20M dataset and compare results in terms of both accuracy, including the macro-averaged F1 score, and latency, including the Time-to-First-Token (TTFT). By fine-tuning the model to understand the language of the Windows Portable Executable format, we demonstrate a significant improvement in macro-averaged F1 score, up to an absolute difference of 50 percentage points over generic LLMs, while maintaining comparable latency.

View source

Similar papers

#small language model Preprint Aug 2026

Towards LLM-Enhanced Android Taint Analysis

Whether off-the-shelf Large Language Models (LLMs) can effectively reason about taint flows in Android apps is investigated, and preliminary findings suggest that LLM reasoning may effectively complement traditional static taint analysis.

Nicholas Miazzo, Marco Alecci, Jordan Samhi et al. · 0 citations
Preprint Jul 2026

Benchmarking LLMs on File System Design and Implementation

This study discloses the model efficiency for different tasks, causes of failed fs tasks, and techniques for mitigating LLM failures, and will open source \phi-Bench to facilitate public research on using LLMs for fs development.

Yu Xue, Daixuan Li, Jian Huang · 0 citations
Review

SDBench: A Survey-based Domain-specific LLM Benchmarking and Optimization Framework

SDBench is introduced, a generic framework for generating evaluation datasets for domain-specific LLMs that reduces the reliance on expert man-power while ensuring that the collected data is uniformly distributed.

Cheng Guo, Kai Hu, Shuxian Liang et al. · 0 citations
Jul 2026

Profiling Lightweight Large Language Models

Lightweight large language models (LLMs) are increasingly being deployed locally on personal computers and are expected to play a growing role in resource-constrained edge and mobile environments. In such settings, energy consumption, execution time, and memory usage directly affect practical usability, yet existing evaluations of LLM efficiency largely rely on proxy descriptors such as parameter count or FLOPs, often decoupled from task precision. This paper introduces a PTME-based experimental framework for the precision-aware profiling of lightweight LLM inference, jointly measuring Precision, execution Time, peak Memory usage, and Energy consumption through direct hardware-level measurements. The methodology is applied to a representative set of lightweight LLMs executed locally under edge-class resource envelopes on a controlled desktop platform, using benchmarks spanning code generation, mathematical reasoning, and multi-task understanding. We find that static proxy descriptors approximate inference cost well but fail to predict precision. Tightening the resource envelope increases cost without affecting precision, amplifying execution time more strongly than energy and penalizing larger models the most. Moreover, no single model dominates across all PTME dimensions, and a Pareto analysis reveals non-dominated configurations that would be hidden by accuracy-only or efficiency-only assessments, providing practical guidance for selecting models under different resource envelopes. These results show that selecting lightweight LLMs by size, FLOPs, latency, or accuracy alone can select the wrong deployment candidate; PTME profiling exposes configurations that preserve useful accuracy at lower physical cost.

Tomohiro Harada, Enrique Alba, Gabriel Luque · 0 citations
Open access 2026

Architecture-Centric Code Migration for Legacy Industrial Systems Using LLMs

This research focuses on Maven configuration and structure updates and explores how the CodeT5 model can automate the migration of Java 8 projects to Java 17, finding the model accelerates parts of migration but remains unsuitable for fully automated use.

Ayush Luhar, Dev Trivedi, Vatsal Patel et al. · 0 citations

Torchy: A Tracing JIT Compiler for PyTorch (Extended Version)

Torchy is presented, a tracing JIT compiler for PyTorch, one of the mainstream eager-mode frameworks, that achieves similar performance as data-flow frameworks, while providing the same semantics of straight-away execution.

Nuno P. Lopes · 0 citations

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.