Machine Learning and Transformers for Malware Analysis: Overview

Malware analysis and detection is a field of cybersecurity, which focuses on classification if a sample has malicious behavior and if it can damage or compromise information technologies or users. Since the creation of the first malware sample defenders have tried to come up with new approaches to detect malicious code and how to analyze it to extract more information about its purpose and its creators. Malware developers also need to refine their techniques to make analysis and detection harder so the result is constant competition between attackers and defenders. In recent years artificial intelligence has become part of malware analysis and detection and has promising results. Transformer models are part of a bigger group called large language models and their application to malware analysis and classification is still at the very beginning but few very recent studies have shown promising results. In this paper, we have first described the basics of malware analysis and its problems like evasive malware and obfuscation. Next, we have looked into basic machine learning techniques and how are they applied in malware analysis. Then we have analyzed the most recent and influential studies about the application of transformer models in this field. Contribution of this paper is in summarizing all identified problems that need to be solved in future work and outlining existing solutions that can be employed for malware classification.