AV-Agent: A Bottom-Up Interpretable Malware Classifier Based on Large Language Models

Malware remains a major cybersecurity threat, driving increased adoption of machine learning (ML)-based analysis methods. However, these ML solutions face challenges in producing explainable and human-readable results, limiting their practical deployment. Large language models (LLMs) offer a promising alternative for transparent ML malware analysis through analyzing character-level features. Despite this potential, the redundant nature of binary files and ambiguous reasoning patterns pose fundamental challenges in applying LLMs to malware binary analysis. To address these challenges, we propose Anti-Virus Agent (AV-Agent), a framework based on large language models for malware detection. AV-Agent implements a streamlined feature processing pipeline, including multi-layer hierarchical feature classifiers, character feature extraction, and two-phase reasoning. By capturing critical malware features, AV-Agent leverages frontier LLMs’ inherent knowledge to achieve transparent and effective malware analysis. Experimental results on a representative dataset indicate that AV-Agent attains comparable performance to analogous machine learning methods, while also providing an explainable malware analysis process. Additionally, the experiments analyzed the parameter settings of AV-Agent and characteristics of experimental results, demonstrating that AV-Agent achieved optimal performance under the specified parameter conditions while maintaining sufficient stability in malware classification outcomes. These findings demonstrate that LLMs exhibit tremendous potential in human-like reasoning analysis of malware.