Malware Analysis with Large Language Models

# Malware Analysis with Large Language Models This is the repository for the python code and dataset used in the paper: *Title:* Malware Analysis with Large Language Models The repository contains the following file and folders: - [dataset/](./dataset/) - Contains all the datasets used in the study, find below a more in depth description of the organisation of the dataset. - [requirements.txt](./requirements.txt) - Contains all the requirements for which are needed to set up the repository, find below the instruction how to install it. - [chunkFiles/](./chunckFiles/) - Contains all the python scripts to chunk the files, find below the instructions who to execute it. - [instructionsLLMs.md](./instructionsLLMs.md) - Contains all the information used for the manual prompting of the LLMs. ## Environment In order to execute the environment, we suggest creating a virtual environment with Python3.12: ```cli python -m venv env source env/bin/activate pip install -r requirements.txt ``` ## Python scripts With the following commands the python scripts are executed as intended: ```cli python chunkFiles/main.py --chunk-size <int chuckSize> --offset <int offset> --file-type <c|asm> --input-folder <PATH/Input> --output-folder <PATH/Output> python adjust_non_printable_characters.py --path <PATH/Input> --escape False --remove True ``` The output path of the first command is the input path of the second command. ## Dataset This repository contains following files:<br> 1.Original files<br> 2.IDA(interactive Disassembler) <br> 3.Ghidra <br> 4.Radare2 <br> This repository contains Assembly and C code representations of 30 malicious and 30 benign files. This is done through 3 different reverse engineering tools i.e.: IDA, Ghidra and Radare2. Each of these folder with the name of reverse engineering tool contains two sub folders of assembly and C files. Which in turn also contain two sub folders for malicious and benign files.