Malware Analysis with Large Language Models

# Malware Analysis with Large Language Models

This is the repository for the python code and dataset used in the paper: 

*Title:* Malware Analysis with Large Language Models

The repository contains the following file and folders:

- [dataset/](./dataset/) - Contains all the datasets used in the study, find below a more in depth description of the organisation of the dataset.

- [requirements.txt](./requirements.txt) - Contains all the requirements for which are needed to set up the repository, find below the instruction how to install it.

- [chunkFiles/](./chunckFiles/) - Contains all the python scripts to chunk the files, find below the instructions who to execute it.

- [instructionsLLMs.md](./instructionsLLMs.md) - Contains all the information used for the manual prompting of the LLMs.

## Environment

In order to execute the environment, we suggest creating a virtual environment with Python3.12:

```cli

python -m venv env

source env/bin/activate

pip install -r requirements.txt

```

## Python scripts

With the following commands the python scripts are executed as intended:

```cli

python chunkFiles/main.py --chunk-size <int chuckSize> --offset <int offset> --file-type <c|asm> --input-folder <PATH/Input> --output-folder <PATH/Output>

python adjust_non_printable_characters.py --path <PATH/Input> --escape False --remove True

```

The output path of the first command is the input path of the second command.

## Dataset

This repository contains following files:<br>

1.Original files<br>

2.IDA(interactive Disassembler) <br>

3.Ghidra <br>

4.Radare2 <br>

This repository contains Assembly and C code representations of 30 malicious and 30 benign files. This is done through 3 different reverse engineering tools i.e.: IDA, Ghidra and Radare2. Each of these folder with the name of reverse engineering tool contains two sub folders of assembly and C files. Which in turn also contain two sub folders for malicious and benign files.