MalLoc: Toward Fine-grained Android Malicious Payload Localization via LLMs

2025-08-25

AI Summary

Traditional Android malware detection struggles to precisely localize malicious payloads and lacks fine-grained, behavior-level identification capability, hindering explainable analysis and targeted defense design. To address this, we propose the first LLM-based framework for function- and statement-level localization of Android malicious payloads, synergistically integrating large language models’ code comprehension with static analysis to semantically reconstruct and interpret malicious intent at the behavioral logic level. Our approach enables dynamic threat modeling, significantly improving both localization accuracy and interpretability. Extensive experiments on multiple benchmark datasets demonstrate substantial performance gains over state-of-the-art conventional methods. This work establishes the first LLM-driven, fine-grained malicious behavior localization framework for mobile security, pioneering a new paradigm for precise, explainable Android malware analysis.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Safety and Robustness
• Intelligent Robots: Localization, Mapping, and Navigation

Application Category

• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

The rapid evolution of Android malware poses significant challenges to the maintenance and security of mobile applications (apps). Traditional detection techniques often struggle to keep pace with emerging malware variants that employ advanced tactics such as code obfuscation and dynamic behavior triggering. One major limitation of these approaches is their inability to localize malicious payloads at a fine-grained level, hindering precise understanding of malicious behavior. This gap in understanding makes the design of effective and targeted mitigation strategies difficult, leaving mobile apps vulnerable to continuously evolving threats. To address this gap, we propose MalLoc, a novel approach that leverages the code understanding capabilities of large language models (LLMs) to localize malicious payloads at a fine-grained level within Android malware. Our experimental results demonstrate the feasibility and effectiveness of using LLMs for this task, highlighting the potential of MalLoc to enhance precision and interpretability in malware analysis. This work advances beyond traditional detection and classification by enabling deeper insights into behavior-level malicious logic and opens new directions for research, including dynamic modeling of localized threats and targeted countermeasure development.

Problem

• Fine-grained localization of Android malicious payloads
• Overcoming limitations of traditional malware detection techniques
• Enhancing precision and interpretability in malware analysis

Innovation

• LLMs for fine-grained Android malware localization
• Enhancing precision and interpretability in analysis
• Enabling deeper insights into malicious logic