MKPL: Multi-dimensional Knowledge-embedded Prompt Learning for Few-shot Malware Family Recognition

Large language models (LLMs) bring great potential for next-generation malware family recognition with their capacity to understand complex code semantics by integrating multi-dimensional data features. However, existing fine-tuning methods still rely on well-labelled datasets and powerful computation resources, which is particularly challenging when the variety and amount of malware grow in real-time. To more effectively recognize unknown malware varieties based on LLMs, a novel multi-dimensional knowledge-embedded prompt learning (MKPL) framework is proposed, in which prompts are generated through two main steps: 1) cross-linguistic prompt paraphrasing (CPP) for embedding multi-dimensional knowledge into templates, and 2) prompt scoring for selecting the most effective prompt templates. Moreover, to reduce feature loss during prompt tuning, a sampling-infer-concatenation pipeline is designated to process these long API malware sequences. Specifically, a single-sentence template can be upgraded to a multi-sentence template by integrating statistic features into CPP, which is essential to improve the robustness of recognition results. Comprehensive experiments across eight malware families in few-shot scenarios demonstrate the proposed method’s superior performance in all metrics.