🤖 AI Summary
This study addresses quality, efficiency, and cost bottlenecks in AI-assisted Linux and IoT malware analysis for 2024–2025. Methodologically, it introduces an “AI–expert collaborative” reverse-engineering paradigm: first systematically validating the practical boundaries of Claude 3.5/3.7 Sonnet on real-world malware; then integrating R2AI (an AI extension for Radare2), static/dynamic analysis, human-in-the-loop prompt engineering, and a feedback-closed loop—where domain experts provide real-time guidance to mitigate hallucination and cyclic reasoning. Results demonstrate: (1) analytical accuracy matching or exceeding manual analysis; (2) significantly accelerated end-to-end analysis—including error correction; and (3) per-sample cost substantially lower than a senior analyst’s daily rate. The core contribution is a deployable, empirically validated AI–human collaborative framework, rigorously demonstrated for state-of-the-art LLMs applied to complex binary reverse engineering—proving both technical efficacy and operational cost-efficiency.
📝 Abstract
This research studies the quality, speed and cost of malware analysis assisted by artificial intelligence. It focuses on Linux and IoT malware of 2024-2025, and uses r2ai, the AI extension of Radare2's disassembler. Not all malware and not all LLMs are equivalent but the study shows excellent results with Claude 3.5 and 3.7 Sonnet. Despite a few errors, the quality of analysis is overall equal or better than without AI assistance. For good results, the AI cannot operate alone and must constantly be guided by an experienced analyst. The gain of speed is largely visible with AI assistance, even when taking account the time to understand AI's hallucinations, exaggerations and omissions. The cost is usually noticeably lower than the salary of a malware analyst, but attention and guidance is needed to keep it under control in cases where the AI would naturally loop without showing progress.