What question did this study set out to answer?

This research examines how Large Language Models (LLMs) can enhance malware evasion techniques compared to traditional methods.

April 27, 2026Open Access

Ver artículo completo

Next-Gen metamorphism: Analyzing the potential of LLM-driven knowledge-based malware evasion

LCL. Coppolino AIA. IannacconeParthenope University of Naples RNR. Nardone

Puntos clave

This research examines how Large Language Models (LLMs) can enhance malware evasion techniques compared to traditional methods.
Utilized commercial LLMs (GPT, Claude, DeepSeek, Gemini) against traditional metamorphic engines (MetaMe) with YARA rule detection.
Conducted experiments to analyze structural diversity and evasion rates of malware variants generated by LLMs versus traditional engines.
Evaluated real-world malware transformations to understand their impact on detection signatures.
LLM-based variants displayed significantly higher structural diversity than those generated by traditional metamorphic engines.
Empirical evidence showed improved evasion rates against signature-based detection for LLM-driven variants.
Analyses revealed that LLM mutations systematically evade YARA signatures while maintaining functionality.

Resumen

Large Language Models (LLMs) have demonstrated advanced capabilities in code generation and manipulation, inspiring growing concerns about their potential to enhance malware obfuscation. Nevertheless, the cybersecurity literature still lacks wide experimental evidence comparing LLM-driven knowledge-based malware evasion to traditional metamorphic engines. This paper addresses this critical research void through three key contributions: (1) a structured methodology leveraging commercial LLMs (GPT, Claude, DeepSeek, Gemini) against traditional metamorphic engines (MetaMe) using YARA rule detection; (2) experimental evidence demonstrating that LLMs produce variants with significantly higher structural diversity and improved evasion against signature-based detection compared to traditional metamorphic engines, generating variants with substantially greater structural diversity and high evasion rates against signature-based detection; and (3) analysis of LLM-transformed real-world malware (Alina-POS) mutations that systematically evade YARA detection signatures while preserving malicious functionality. Our key insight reveals that LLMs leverage semantic understanding rather than syntactic transformations to achieve effective structural variation in code generation. These findings suggest an emerging trend towards knowledge-based evasion techniques, creating a computational asymmetry where generating sophisticated malware variants requires significantly less expertise and effort than detecting them. This emerging imbalance highlights potential challenges for current malware detection approaches and defensive strategies. • Large Language Models can generate malware variants with higher structural diversity than traditional metamorphic engines. • Empirical analysis shows LLM-based variants achieve improved evasion against signature-based detection. • Evaluation across syscall patterns and structural metrics characterizes transformation behavior and its impact on detection signatures.

Preguntar a la IA

Me gusta

Guardar

Ver artículo completo

Cite This Study

Coppolino et al. (Wed,) studied this question.

synapsesocial.com/papers/69eefc6dfede9185760d36d5 https://doi.org/https://doi.org/10.1016/j.knosys.2026.116056

Preguntar a la IA

Me gusta

Guardar

Ver artículo completo