Adaptive Symbolic Execution with LLMs for Evasive Malware Analysis -- The 56th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Charlotte, USA, June 22-25, 2026
Academic Article
Overview
Overview
Abstract
Modern evasive malware presents fundamental challenges to traditional symbolic execution, as performance degradation is driven not by binary size but by internal code complexity and sophisticated evasion tactics. Our SymExE framework demonstrates that generic symbolic execution strategies are ineffective against malware employing obfuscation, anti-analysis, and environment-aware behaviors. This work proposes two complementary research directions. First, we introduce a taxonomy-driven analysis of evasive malware techniques that systematically characterizes how specific tactics impact symbolic execution performance, solver behavior, and path explosion. Second, we propose integrating large language models (LLMs) to provide intelligent, real-time guidance during symbolic execution by prioritizing high-value execution paths and reducing exploration of decoy behaviors. This paper represents a work in progress toward transforming symbolic execution into an adaptive analysis framework for evasive malware.
