LLM-assisted Dynamic Malware Detection Method based on Graph Attention Network

The rapid evolution of malware poses significant challenges for cybersecurity. Recent research has explored extracting API sequences from malware behaviors and applying deep learning for detection. However, most existing approaches neglect the rich semantic information within API calls, leading to suboptimal feature extraction. In this paper, we propose a novel malware detection framework based on Graph Neural Networks, which integrates GPT-assisted semantic enrichment and a customized data augmentation strategy. API sequences are converted into graph-structured data, where node features are enhanced using GPT-generated API call descriptions and BERT embeddings to capture comprehensive semantics. Carefully designed prompts enable GPT-4o to generate concise and informative descriptions, while Retrieval-Augmented Generation further aligns generated text with malware analysis. To combat overfitting, we introduce a subgraph cropping algorithm based on node importance, creating semantically consistent subgraphs for augmentation. Both original and augmented graphs are fed into a Graph Attention Network, substantially improving malware classification performance. We evaluate our framework on two publicly available datasets, achieving improvements of 2.38% and 2.67% over state-of-the-art methods. Ablation studies show that both semantic enrichment and graph-based data augmentation independently enhance performance, with the best results when combined.