Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models

arXiv cs.AI / 4/6/2026

💬 OpinionIdeas & Deep AnalysisModels & Research

共有:

Key Points

The paper tackles malware family classification in open-world conditions where obfuscation and packing make traditional supervised ML approaches reliant on labeled data and handcrafted features less scalable.
It proposes a zero-label framework that uses a weighted hierarchical ensemble of pretrained LLMs, combining multiple models’ decision-level outputs instead of training or feature learning.
The ensemble weights each LLM’s contribution using empirically derived macro-F1 scores and applies a hierarchical strategy that first determines coarse malicious behavior and then refines to fine-grained malware families.
The authors argue the hierarchical aggregation improves robustness and reduces instability from any single model while better matching analyst-style reasoning.

Abstract

Malware family classification remains a challenging task in automated malware analysis, particularly in real-world settings characterized by obfuscation, packing, and rapidly evolving threats. Existing machine learning and deep learning approaches typically depend on labeled datasets, handcrafted features, supervised training, or dynamic analysis, which limits their scalability and effectiveness in open-world scenarios. This paper presents a zero-label malware family classification framework based on a weighted hierarchical ensemble of pretrained large language models (LLMs). Rather than relying on feature-level learning or model retraining, the proposed approach aggregates decision-level predictions from multiple LLMs with complementary reasoning strengths. Model outputs are weighted using empirically derived macro-F1 scores and organized hierarchically, first resolving coarse-grained malicious behavior before assigning fine-grained malware families. This structure enhances robustness, reduces individual model instability, and aligns with analyst-style reasoning.