Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models
This addresses the problem of scalable and effective malware classification for cybersecurity analysts in real-world scenarios with obfuscation and evolving threats, representing a novel method for a known bottleneck.
The paper tackles malware family classification by proposing a zero-label framework using a weighted hierarchical ensemble of pretrained large language models, which aggregates decision-level predictions to enhance robustness and reduce instability without relying on labeled data or retraining.
Malware family classification remains a challenging task in automated malware analysis, particularly in real-world settings characterized by obfuscation, packing, and rapidly evolving threats. Existing machine learning and deep learning approaches typically depend on labeled datasets, handcrafted features, supervised training, or dynamic analysis, which limits their scalability and effectiveness in open-world scenarios. This paper presents a zero-label malware family classification framework based on a weighted hierarchical ensemble of pretrained large language models (LLMs). Rather than relying on feature-level learning or model retraining, the proposed approach aggregates decision-level predictions from multiple LLMs with complementary reasoning strengths. Model outputs are weighted using empirically derived macro-F1 scores and organized hierarchically, first resolving coarse-grained malicious behavior before assigning fine-grained malware families. This structure enhances robustness, reduces individual model instability, and aligns with analyst-style reasoning.