Multi-View Decompilation for LLM-Based Malware Classification
This work proposes a novel multi-decompiler view fusion strategy to address the limitations of existing large language model (LLM)-based malware classification approaches that rely on a single decompiler view and are thus prone to information loss and fragility. By leveraging complementary pseudo-C code generated by Ghidra and RetDec, the method employs prompt engineering to guide multiple mainstream LLMs in performing classification without requiring additional training, thereby enhancing their ability to recognize malicious samples. Experimental evaluation on a custom benchmark dataset demonstrates that the proposed approach significantly improves F1 scores and recall across malicious classes, effectively validating the efficacy and complementarity of integrating multiple decompiler views for robust malware analysis.