MALBOT: An Automated Framework for LLM-Driven Malware Analysis from Network Packet Captures

Abstract:

The escalating sophistication and frequency of malware attacks strain traditional detection and analysis methods, which often require manual effort and fragmented tooling. This paper presents MalBot, an automated malware investigation framework that processes network packet captures (PCAPs) end-to-end. MalBot automatically extracts transferred files from captured traffic, identifies potentially malicious applications, and enriches findings with multi-source threat intelligence via APIs, alongside reverse engineering output. All extracted intelligence including static, dynamic, and network-level indicators is consolidated into a structured dataset (CSV). A large language model (LLM) serves as the analytical interface: when a user submits a natural-language query, the model generates and executes Python code to interrogate the dataset, then returns a concise, human-readable summary. This architecture unifies diverse analysis stages into a single, reproducible workflow, reducing analyst workload and enabling rapid, accessible malware investigations for both technical and non-technical users.

Add your vote

Please register or login to website to vote for this Project.

AUTHORS

Password must be at least 8 characters long and include one uppercase letter, one lowercase letter, one number, and one special character.

AdBlock

We rely on ads to maintain this site. Disabling your ad blocker helps us serve you better.