LLM-SGCF: A Robust Malware Detection Framework with Spatially Guided Convolution

With the rapid evolution of cyberattack techniques, identifying dynamic behavioral intents from Application Programming Interface call sequences has become a fundamental modality for ensuring reliable malware detection and information security. However, existing detection methods face the dual challenges of semantic sparsity and inadequate spatial dependency modeling when processing these sequences, which fundamentally undermines their stability against complex structural variations and in-the-wild evasive patterns. To address these critical vulnerabilities, we propose LLM-SGCF, a highly effective malware detection framework that jointly models deep behavioral semantics and spatial structures. Specifically, our framework leverages generative Large Language Models, which are subsequently encoded by BERT, to transform sparse API calls into rich and contextualized descriptions. Concurrently, it employs a novel Spatially Guided Convolution (SGC) module to localize critical malicious segments and extract cross-position dependencies in a two-dimensional semantic space. Extensive experiments on the public Aliyun and Catak datasets demonstrate that LLM-SGCF exhibits exceptional resilience to real-world structural complexity and significantly outperforms state-of-the-art baselines, achieving a peak binary-classification accuracy of 95.82%. Further ablation analyses confirm that the synergistic fusion of semantic enhancement driven by Large Language Models and spatial structural modeling dramatically improves the resilience of the framework against complex attack chains, providing a highly reliable paradigm for next-generation malware recognition systems.