{"id":"https://openalex.org/W4413120804","doi":"https://doi.org/10.1109/tifs.2025.3597221","title":"AV-Agent: A Bottom-Up Interpretable Malware Classifier Based on Large Language Models","display_name":"AV-Agent: A Bottom-Up Interpretable Malware Classifier Based on Large Language Models","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4413120804","doi":"https://doi.org/10.1109/tifs.2025.3597221"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3597221","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3597221","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076280711","display_name":"Rui Zheng","orcid":"https://orcid.org/0000-0002-9592-3283"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rui Zheng","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","The State Key Laboratory of Blockchain and DataSecurity, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-9592-3283","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]},{"raw_affiliation_string":"The State Key Laboratory of Blockchain and DataSecurity, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100422345","display_name":"Zhibo Wang","orcid":"https://orcid.org/0000-0002-5804-3279"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhibo Wang","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","The State Key Laboratory of Blockchain and DataSecurity, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-5804-3279","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]},{"raw_affiliation_string":"The State Key Laboratory of Blockchain and DataSecurity, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5105297718","display_name":"Kui Ren","orcid":"https://orcid.org/0000-0002-1969-2591"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kui Ren","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","The State Key Laboratory of Blockchain and DataSecurity, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-1969-2591","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]},{"raw_affiliation_string":"The State Key Laboratory of Blockchain and DataSecurity, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100373367","display_name":"Chun Chen","orcid":"https://orcid.org/0000-0002-6198-7481"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chun Chen","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","The State Key Laboratory of Blockchain and DataSecurity, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-6198-7481","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]},{"raw_affiliation_string":"The State Key Laboratory of Blockchain and DataSecurity, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I76130692"],"apc_list":null,"apc_paid":null,"fwci":0.9024,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.74912195,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"20","issue":null,"first_page":"8555","last_page":"8569"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9962000250816345,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9836999773979187,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8611075282096863},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7721947431564331},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.5856524705886841},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5308846831321716},{"id":"https://openalex.org/keywords/natural-language-processing","display_name":"Natural language processing","score":0.4489426612854004},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.4382960796356201},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.33336755633354187},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.12102362513542175}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8611075282096863},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7721947431564331},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.5856524705886841},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5308846831321716},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.4489426612854004},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.4382960796356201},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.33336755633354187},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.12102362513542175}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3597221","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3597221","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G516804674","display_name":null,"funder_award_id":"2024C01164","funder_id":"https://openalex.org/F4320317323","funder_display_name":"Key Research and Development Program of Heilongjiang"},{"id":"https://openalex.org/G8999494135","display_name":null,"funder_award_id":"U24B20182","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320317323","display_name":"Key Research and Development Program of Heilongjiang","ror":null},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":30,"referenced_works":["https://openalex.org/W1893133781","https://openalex.org/W2010065958","https://openalex.org/W2161336914","https://openalex.org/W2890991187","https://openalex.org/W2904109097","https://openalex.org/W2969904462","https://openalex.org/W3007070494","https://openalex.org/W3175941285","https://openalex.org/W3213145987","https://openalex.org/W4281477228","https://openalex.org/W4360603904","https://openalex.org/W4388858920","https://openalex.org/W4388886073","https://openalex.org/W4394769342","https://openalex.org/W4396242417","https://openalex.org/W4400612817","https://openalex.org/W4402264467","https://openalex.org/W4411523122","https://openalex.org/W4411997068","https://openalex.org/W6737947904","https://openalex.org/W6739901393","https://openalex.org/W6745899033","https://openalex.org/W6778883912","https://openalex.org/W6779329203","https://openalex.org/W6850283204","https://openalex.org/W6851775633","https://openalex.org/W6859679198","https://openalex.org/W6861530698","https://openalex.org/W6874182305","https://openalex.org/W6874886628"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W4284893819","https://openalex.org/W3152891574","https://openalex.org/W4316881845","https://openalex.org/W2975527072"],"abstract_inverted_index":{"Malware":[0],"remains":[1],"a":[2,36,80,92,129],"major":[3],"cybersecurity":[4],"threat,":[5],"driving":[6],"increased":[7],"adoption":[8],"of":[9,54,158,162,196],"machine":[10,140],"learning":[11,141],"(ML)-based":[12],"analysis":[13,43,149,195],"methods.":[14],"However,":[15],"these":[16,73],"ML":[17,41],"solutions":[18],"face":[19],"challenges":[20,63],"in":[21,64,180,192],"producing":[22],"explainable":[23,147],"and":[24,57,105,122,160],"human-readable":[25],"results,":[26,164],"limiting":[27],"their":[28],"practical":[29],"deployment.":[30],"Large":[31],"language":[32,85],"models":[33,86],"(LLMs)":[34],"offer":[35],"promising":[37],"alternative":[38],"for":[39,87],"transparent":[40,121],"malware":[42,68,88,111,124,148,181],"through":[44],"analyzing":[45],"character-level":[46],"features.":[47],"Despite":[48],"this":[49],"potential,":[50],"the":[51,152,155,172],"redundant":[52],"nature":[53],"binary":[55,69],"files":[56],"ambiguous":[58],"reasoning":[59,194],"patterns":[60],"pose":[61],"fundamental":[62],"applying":[65],"LLMs":[66,188],"to":[67,119,138],"analysis.":[70,125],"To":[71],"address":[72],"challenges,":[74],"we":[75],"propose":[76],"Anti-Virus":[77],"Agent":[78],"(AV-Agent),":[79],"framework":[81],"based":[82],"on":[83,128],"large":[84],"detection.":[89],"AV-Agent":[90,113,134,159,167],"implements":[91],"streamlined":[93],"feature":[94,100,103],"processing":[95],"pipeline,":[96],"including":[97],"multi-layer":[98],"hierarchical":[99],"classifiers,":[101],"character":[102],"extraction,":[104],"two-phase":[106],"reasoning.":[107],"By":[108],"capturing":[109],"critical":[110],"features,":[112],"leverages":[114],"frontier":[115],"LLMs\u2019":[116],"inherent":[117],"knowledge":[118],"achieve":[120],"effective":[123],"Experimental":[126],"results":[127],"representative":[130],"dataset":[131],"indicate":[132],"that":[133,166,187],"attains":[135],"comparable":[136],"performance":[137,170],"analogous":[139],"methods,":[142],"while":[143,176],"also":[144],"providing":[145],"an":[146],"process.":[150],"Additionally,":[151],"experiments":[153],"analyzed":[154],"parameter":[156,174],"settings":[157],"characteristics":[161],"experimental":[163],"demonstrating":[165],"achieved":[168],"optimal":[169],"under":[171],"specified":[173],"conditions":[175],"maintaining":[177],"sufficient":[178],"stability":[179],"classification":[182],"outcomes.":[183],"These":[184],"findings":[185],"demonstrate":[186],"exhibit":[189],"tremendous":[190],"potential":[191],"human-like":[193],"malware.":[197]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2025-12-22T23:10:17.713674","created_date":"2025-10-10T00:00:00"}