Trident: Improving Malware Detection with LLMs and Behavioral Features

2026-04-30

AI Summary

This work addresses the limitations of traditional malware detection approaches, which rely heavily on static features and struggle to effectively leverage semi-structured behavioral reports generated by sandboxing while remaining vulnerable to concept drift. To overcome these challenges, the authors propose Trident, a novel system that introduces, for the first time, a reasoning-capable large language model (LLM) to efficiently parse behavioral reports and automatically generate robust detection rules that do not require frequent retraining. Trident integrates static features, LLM-generated rules, and direct LLM-based analysis through a majority voting mechanism to achieve multi-source information fusion. Experimental results demonstrate that Trident outperforms purely static and single-behavior-rule methods in detection performance, exhibits robustness to concept drift comparable to active learning approaches, and maintains a low false positive rate.

Abstract

Traditionally, machine learning methods for PE malware detection have relied on static features like byte histograms, string information, and PE header contents. One barrier to incorporating dynamic analysis features has been the semi-structured nature of sandbox behavior reports. We show that, using the latest generation of large language models with reasoning, it is possible to efficiently process these behavior reports and utilize them as part of a malware detection pipeline. Specifically, we leverage LLMs to generate behavior-based malware detection rules based on a small training set of labeled malware. We find that these detection rules, derived from behavioral features, are much more robust to concept drift than standard static-feature methods, while maintaining practical false positive rates. Finally, we introduce Trident, a system which combines a classic decision tree model over static features, our behavior-based detection rules, and direct LLM analysis of sandbox reports through majority voting. Trident outperforms standard methods using static features, outperforms behavior-based rules alone, and is as resilient to concept drift as active learning methods without requiring retraining.

Problem

• malware detection
• behavioral features
• concept drift
• sandbox reports
• PE files

Innovation

• Large Language Models
• Behavioral Features
• Malware Detection
• Concept Drift
• Sandbox Reports