Skip to content

Malaika: Understanding Malware through Tri-Grounded Agentic Reasoning

🕒 Published (v1): 2026-07-10 08:13 UTC · Source: Arxiv · link

Why this paper was selected

Tri-grounded agentic reasoning under partial observability; novel reasoning scaffold for tool-use agents

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Malaika is a tri-grounded multi-agent framework for Android malware understanding that structures LLM reasoning through domain, semantics, and knowledge grounding mechanisms. It operationalizes an Explorer–Reviewer loop with static-analysis tooling and MITRE ATT&CK retrieval to produce auditable, evidence-linked behavioral reports. Ablation and comparison results show that harness structure — not base model capability alone — determines reliability in malware reasoning.

Problem

Existing LLM-based malware analysis relies on fixed single-pass pipelines (e.g., hierarchical prompting, slicing-based approaches) that do not control how behavioral hypotheses are generated, checked, or tied back to evidence. General-purpose frontier agents (Codex, Claude Code) optimize for coverage and capability but fail under partial observability: they produce overconfident behavioral claims from fragmentary evidence because they lack mechanisms to enforce evidence sufficiency before propagating a conclusion. The core challenge is not locating suspicious code but verifying whether a behavior hypothesis is sufficiently grounded in concrete program semantics.

Method

Malware analysis is formulated as an iterative grounded reasoning trajectory: $\(R(a) = \{(h_t, C_t, E_t)\}_{t=0}^T\)$ where \(h_t\) is the current behavior hypothesis, \(C_t\) is accumulated context, and \(E_t\) is supporting evidence at step \(t\). Three complementary grounding mechanisms are realized:

  1. Domain grounding: Four specialized roles — Manifest Analyzer (attack-surface overview), Explorer (hypothesis generation from localized targets), Reviewer (evidence sufficiency and logical consistency audit), Summarizer (aggregation of Reviewer-accepted findings). The Explorer–Reviewer loop forces re-analysis when evidence is incomplete or contradictory; only accepted findings propagate.

  2. Semantics grounding: Static analysis via Androguard extracts entry points, call-graph edges, sensitive API calls, and suspicious strings from APKs. The Explorer invokes three tools adaptively: getFunctionSummary, getFunctionCallers, getClassSummary. Candidate targets are ranked by density of sensitive API/string hits and dispatched in priority order to up to 5 parallel Explorer–Reviewer threads. Analysis halts once 5 Reviewer-accepted malicious findings are obtained.

  3. Knowledge grounding: MITRE ATT&CK Mobile techniques (mobile-attack-18.0 STIX bundle) are embedded with text-embedding-3-large and indexed in FAISS. The Explorer queries this index only after observing a concrete behavior; the Reviewer rejects any ATT&CK mapping unsupported by retrieved evidence. The Summarizer is prohibited from introducing new technique IDs not validated during localized analysis.

Implementation uses LangGraph for agent orchestration. Baselines include LAMD, MalEval pipeline, Codex, and Claude Code.

Key Contributions

  • Formulation of malware understanding as grounded reasoning under partial observability, distinguishing it from vulnerability discovery.
  • Identification of three complementary grounding requirements (domain, semantics, knowledge) as distinct failure-mode mitigations.
  • Malaika framework: analyst-inspired role structure + Android static-analysis tooling + on-demand ATT&CK retrieval.
  • Empirical capability–reliability–cost tradeoff analysis against prior LLM pipelines and frontier agentic systems, showing harness structure is a first-class reliability determinant.

Results

  • Malaika improves report-level malware-understanding quality over both prior LLM-based systems (LAMD, MalEval pipeline) on the full MalEval benchmark (255 apps: 230 malware, 25 benign).
  • Against frontier coding agents (Codex, Claude Code), Malaika achieves a more precision-oriented and lower-cost operating point.
  • Ablation confirms the three grounding types address complementary failure modes: removing any one degrades distinct aspects (hypothesis quality, evidence localization, attribution accuracy).
  • An open-weight model wrapped in the Malaika harness outperforms stronger base models without the grounded harness, directly supporting the claim that harness structure drives reliability.
  • A targeted 20-sample Mobile ATT&CK attribution audit validates knowledge grounding's effect on technique-mapping precision.

(Note: specific F1/precision/recall numbers are not present in the provided text excerpt.)

Limitations

  • MalEval benchmark is small (255 samples) and Android-only; generalization to other platforms and larger corpora is not demonstrated.
  • Stopping criteria (5 parallel threads, 5 accepted findings) are fixed heuristics, not systematically tuned.
  • Static call-graph construction does not capture all behaviorally relevant transitions (e.g., asynchronous framework-mediated flows), leaving residual partial observability the LLM must bridge.
  • Knowledge grounding is limited to MITRE ATT&CK Mobile; coverage of non-ATT&CK threat knowledge is not addressed.
  • Evaluation relies on analyst-validated annotations from a single benchmark source; inter-annotator agreement and annotation coverage are not discussed in the excerpt.

Relevance to Harnesses / Meta-Harnesses

This paper makes an explicit, empirically supported argument that the harness is a first-class system property: the same base model produces substantially different reliability depending on the surrounding reasoning scaffold. It demonstrates concrete harness design principles — role decomposition, review gates, tool-mediated scope expansion, retrieval-gated attribution — that prevent capability from being mistaken for reliability. The ablation methodology provides a reusable template for isolating individual harness components' contributions. For harness researchers, Malaika is a case study in domain-specific harness instantiation: a general tri-grounding framework instantiated for a security domain, showing how principled harness structure enables open-weight models to match or exceed frontier agents on precision-critical tasks.