MARS: Malware Analysis with Rule-Based Scoring of LLM Claims
We present MARS, a malware triage framework, and compare direct classification with single-pass claim scoring using the same evidence collector and identical static evidence bundles for each model.
ProofPaper ↗
Key points
- Large language models can triage malware through direct verdicts or behavioral claims scored by an external policy.
- Direct classification is more accurate for all six models.
- Claim mediation provides no consistent reduction in performance variation across models.
- Separate subset studies find more consistent alert decisions for direct classification and a larger recall loss for the claim path when predefined indicator fields are removed.
Sources (1)
- [1]MARS: Malware Analysis with Rule-Based Scoring of LLM ClaimsarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 7, 06:55 AM
We present MARS, a malware triage framework, and compare direct classification with single-pass claim scoring using the same evidence collector and identical static evidence bundles for each model.
Large language models can triage malware through direct verdicts or behavioral claims scored by an external policy.
Extractive summary: sentences quoted from the sources.