Evaluating the Impact of LLM-Assisted CodeTransformation on Static Malware Detection

Sammanfattning

This study investigates how Large Language Models (LLMs) can affectstatic malware detection by transforming malicious code into versionsthat are harder to detect while still maintaining the same functionality.To investigate this, an experimental pipeline was created using WindowsPortable Executable (.exe) malware samples. The samples werefirst verified through VirusTotal, then analyzed and decompiled usingGhidra. After that, the code was transformed using two LLMs: OpenAIGPT-4 and Google Gemini. The transformed versions were then testedagain using the same static analysis and rule-based scoring frameworkto compare the detection results before and after modification.The evaluation focused on several malware-related characteristics,including API usage patterns, obfuscation techniques, and code complexity.The results showed that LLM-generated transformations cannoticeably impact the effectiveness of static malware detection systems.Among the two models, GPT-4 delivered the strongest performance,reducing malware scores by an average of 64.31% and frequentlylowering the risk classification from Medium to Low. Gemini alsoreduced detection scores, achieving an average reduction of 48.60%,but it often introduced unnecessary structural complexity. In somecases, the transformed code became more than 800% more complexwithout providing a proportional improvement in evasion capability.The findings suggest that precise and controlled code modificationsare more effective than aggressive transformations. GPT-4 generallyproduced more stable and security-oriented changes, whereas Geminishowed better compilation reliability but less consistent successin reducing detection scores. The study also highlights importantweaknesses in traditional static analysis approaches, demonstratinghow AI-driven code transformations can reduce the effectiveness ofsignature-based and rule-based malware detection methods.Overall, this research highlights the growing role of AI in cybersecurity,particularly in malware transformation and evasion techniques.The results underline the need for more advanced and adaptive detectionmethods that combine behavioral analysis, dynamic analysis,and AI-resilient security strategies to better defend against emergingAI-assisted cyber threats.