Trident: Using LLMs to Read Malware Behavior Reports for Better Detection

Forum topic · 小凯 · 2026-05-04

Summary

Trident is a research paper by Rebecca Saul, Jingzhi Jiang, Elliott Chia, and David Wagner (arXiv:2605.00297) that proposes using reasoning-capable large language models to improve malware detection. The key idea is to have LLMs process sandbox-generated behavioral reports—records of file operations, network connections, registry modifications, and process creation—and turn them into human-readable behavioral detection rules. Traditional static detection relies on byte histograms, strings, and PE headers, all of which malware can evade through packing and obfuscation. Dynamic reports capture what malware actually does, but their semi-structured complexity makes them hard for conventional machine learning to exploit. Trident addresses this by having LLMs reason over behavior semantics and generate interpretable, updatable rules from a small number of training samples. Combining static and behavioral features yields more robust detection that is harder to bypass, since malicious intent must ultimately manifest as actions. The paper's central insight: behavior is a more reliable and honest signal than file appearance, turning malware detection from a static gatekeeper into a dynamic detective.

Paper

Title: Trident: Improving Malware Detection with LLMs and Behavioral Features
Authors: Rebecca Saul, Jingzhi Jiang, Elliott Chia, David Wagner
arXiv: 2605.00297 (2026-04-29)

The security arms race: malware learned to disguise itself

Traditional malware detection relies mostly on static features:

Byte histograms
String information
PE header contents

The problem: malware can alter these attributes through packing, obfuscation, and PE header manipulation, rendering static features ineffective.

Dynamic analysis runs suspicious files in a sandbox and observes their behavior, producing detailed reports. However, these reports are semi-structured and complex—difficult for traditional ML models to exploit effectively.

What Trident does

Trident's core idea:

> Use the latest generation of reasoning-capable LLMs to efficiently process sandbox behavior reports and generate behavior-based malware detection rules.

The pipeline:

1. Sandbox behavior reports — run suspicious files in an isolated environment and record all behavior: file operations, network connections, registry modifications, process creation.

2. LLM processing — instead of traditional ML, an LLM with reasoning capability understands the semantics of behaviors and identifies malicious patterns.

3. Rule generation — from a small number of training samples, the LLM generates behavioral rules such as "if behavior X appears, it may be malicious." Rules are interpretable and updatable.

4. Static + dynamic combination — pairing static features with behavioral features provides dual coverage and is harder to bypass.

An analogy:

Traditional detection = judging a suspect by appearance — easy to disguise.
Trident = judging a suspect by behavior: "connecting to a foreign server at midnight," "modifying system files," "creating hidden processes." Behavior patterns are much harder to fake and more accurate as a signal.

Why behavioral features beat static features

Problems with static features:

Easily bypassed via packing, obfuscation, PE header edits
Superficial: they inspect what a file looks like, not what it does

Advantages of behavioral features:

Hard to disguise: malicious goals require action, and actions expose intent
Deeper: they look at what a file does, not what it is
Interpretable: clear rules explain why a sample was flagged as malicious

Takeaways

If you are building security systems or malware detection, ask:

1. Does my detection rely only on static features? 2. Are behavior reports being fully exploited? 3. Can LLMs understand complex behavioral patterns? 4. Is a static + dynamic combination more robust?

Trident reminds us: in the security arms race, "behavior" is more reliable than "appearance." When malware detection shifts from "looking at files" to "looking at behavior," it evolves from a static gatekeeper into a dynamic detective. In cybersecurity, behavior is the most honest witness.