2025 · Journal article
Malsight: Exploring Malicious Source Code and Benign Pseudocode for Iterative Binary Malware Summarization
MALSIGHT writes natural-language summaries of stripped binary malware one function at a time. IDA Pro produces pseudocode and a call graph, and functions are summarized callees first, so each caller receives its callees' summaries as context; a sequence-labeling model also marks key API calls and strings, which drive code-search retrieval and LLM-written annotations. The summarizer, MalT5, is a 0.77B-parameter CodeT5+ model fine-tuned first on MalS, 89,609 malicious C source functions from GitHub with LLM-generated summaries refined by human reviewers, and then on annotated benign pseudocode from the Capybara dataset. The authors also introduce MalP, 500 pseudocode functions for testing, and BLEURT-sum, a fine-tuned BLEURT metric, and report that MalT5 performs comparably to much larger Code Llama models.
Scope and limitations
Training summaries are LLM-generated and then reviewed and refined by five experts rather than written from scratch. MalP's 500 test functions come from compiling and decompiling 20 of the same GitHub malware repositories, not from wild samples, and the authors note that loose filtering may let training and test data overlap and inflate results. Quality is scored mainly with the authors' own BLEURT-sum metric. On ten real malware samples, with 79 functions also rated by three reverse engineers, BLEURT-sum was about 30% lower than on MalP, which the authors attribute to long functions: 15.8% exceed 1,000 tokens, while most training functions are under 300. The pipeline depends on IDA Pro pseudocode, and static annotation relies on online code search and a general-purpose LLM. MALSIGHT summarizes behavior; it is not a malware detector or classifier.
Why it fits this collection
Adds LLM-based summarization of stripped malware pseudocode that follows the call graph, complementing decompilation, symbol-recovery and benchmark records that include binary code summarization.
Publication and review details
- Venue
- IEEE Transactions on Information Forensics and Security
- Status
- Journal article
- Publication / posting date
- 2025 (exact date not verified)
- Date source
- IEEE's Crossref deposit gives only the 2025 publication year for volume 20. The 2025-06-26 DOI-registration date and the arXiv dates are not used to assert a month or day.
- First arXiv submission
- June 26, 2024
- arXiv
- 2406.18379
- Reviewed arXiv version
- v3
- DOI
- 10.1109/TIFS.2025.3583552
Crossref records volume 20, pages 6733–6747, and the nine-author order, which matches arXiv; it spells the title 'Malsight', while arXiv and the paper write MALSIGHT, and the record follows the publisher title. IEEE Xplore could not be retrieved, so publication facts follow Crossref and the reviewed text is arXiv v3 (2025-06-17), whose comment states acceptance by IEEE TIFS; v1 is dated 2024-06-26 and v2 2024-11-06. The paper reports extracting close to 30K functions from 2,289 repositories before giving the 89,609-function MalS total, and calls MalT5 0.7B in its contribution list and 0.77B elsewhere. Footnote 1 promises a source-code release but gives no link. The repository lhl7/Malsight, described as 'code for Malsight', is owned by an account whose profile name matches the first author, but neither the paper nor an author page links it, so code_url stays null. At the reviewed 2025-07-24 commit it has no license file and links Apache-2.0 Hugging Face models (sequence labeling, CodeT5+ 770M, BLEURT) and datasets. Nothing was downloaded or run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.