Cited by 27Advanced Malware Detection TechniquesSoftware Engineering ResearchSecurity and Verification in Computing

Large language model (LLM) for software security: Code analysis, malware analysis, reverse engineering

Open access
Jelodar, Hamed, Bai, Samita, Hamedi, Parisa, Mohammadian, Hesamodin, Razavi-Far, Roozbeh, Ghorbani, Ali·2026·Journal of Information Security and Applications

Abstract

Large Language Models (LLMs) have recently emerged as powerful tools in cybersecurity, offering advanced capabilities in malware detection, generation, and real-time monitoring. Numerous studies have explored their application in cybersecurity, demonstrating their effectiveness in identifying novel malware variants, analyzing malicious code structures, and enhancing automated threat analysis. Several transformer-based architectures and LLM-driven models have been proposed to improve malware analysis, leveraging semantic and structural insights to recognize malicious intent more accurately. This study presents a comprehensive review of LLM-based approaches in malware code analysis, summarizing recent advancements, trends, and methodologies. We examine notable scholarly works to map the research landscape, identify key challenges, and highlight emerging innovations in LLM-driven cybersecurity. Additionally, we emphasize the role of static analysis in malware detection, introduce notable datasets and specialized LLM models, and discuss essential datasets supporting automated malware research. This study serves as a valuable resource for researchers and cybersecurity professionals, offering insights into LLM-powered malware detection and defense strategies while outlining future directions for strengthening cybersecurity resilience.

Integrity signals

Registry

Crossref · 10.1016/j.jisa.2026.104390

Cites

54 of 54 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • LLMs have already been examined for cyber threat detection, threat-intelligence analysis, malware investigation support, and higher-level security reasoning, no longer confined to traditional classification pipelines or rule-based systems.

    “According to recent studies, LLMs have already been examined for cyber threat detection, threat-intelligence analysis, malware investigation support, and higher-level security reasoning, no longer confined to traditional classification pipelines or rule-based systems [12], [13].”

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Authors
Jelodar, H., Bai, S., Hamedi, P., Mohammadian, H., Razavi-Far, R., & Ghorbani, A.
Affiliations
University of New Brunswick (CA)
Corresponding author
Jelodar, Hamed
Venue
Journal of Information Security and Applications
Publisher
Elsevier BV
Published
2026-05
Volume
98
Pages
104390
ISSN
2214-2126 (ISSN-L)
OpenAlex
W7128505394
Cited by
27
References
53
Citations by year
2026: 25 · 2025: 2
FWCI
96.39
Type
journal article
Language
en
Open access
Locations
  • Journal of Information Security and Applications (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion)
Topics
  • Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Research
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
Keywords
large language models, software security, code analysis, malware analysis, reverse engineering

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review