Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs

This is the repository associated with the Master’s Degree Project, [Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs](https://www.diva-portal.org/smash/get/diva2:1973561/FULLTEXT01.pdf) (120 ECTS) in Informatics with a Specialization in Privacy, Information and Cyber Security, created during the Spring term 2025. The entire project is released under the Apache 2.0 license and is free to use in further research or other types of development. Although it is not explicitly required to include any citations to the original degree project, it is greatly appreciated if the material is used.

promptBeginner5 min to valuemarkdown

0 views

Jan 14, 2026

Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs

This is the repository associated with the Master’s Degree Project, Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs (120 ECTS) in Informatics with a Specialization in Privacy, Information and Cyber Security, created during the Spring term 2025. The entire project is released under the Apache 2.0 license and is free to use in further research or other types of development. Although it is not explicitly required to include any citations to the original degree project, it is greatly appreciated if the material is used.

Prerequisites

To run this project, the system needs a working Python environment. The framework was developed with Python 3, which is therefore the recommended environment.
Additionally, the Ollama platform is used by the framework and needs to be downloaded and installed to run the analyses. Installation is easiest performed with the command:
```
curl -fsSL https://ollama.com/install.sh | sh
```
At least one LLM must also be downloaded from Ollama for use by the framework. However, to reproduce the study, all the LLMs used in the project and listed below need to be downloaded:
For labeling and downloading malware with the framework, the user also needs to obtain and enter API keys in the user settings that is used in the project.
- VirusTotals API key is obtained by creating an account on VirusTotal.com.
- MalwareBazaars API key is obtained by creating an account on Abuse.ch.

For complete instructions about running and modifying the framework, please refer to the written report, Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs.

Contact

For any questions about the repository or the master thesis contact [email protected].

Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs

Prerequisites

To run this project, the system needs a working Python environment. The framework was developed with Python 3, which is therefore the recommended environment.
Additionally, the Ollama platform is used by the framework and needs to be downloaded and installed to run the analyses. Installation is easiest performed with the command:
```
curl -fsSL https://ollama.com/install.sh | sh
```
At least one LLM must also be downloaded from Ollama for use by the framework. However, to reproduce the study, all the LLMs used in the project and listed below need to be downloaded:
For labeling and downloading malware with the framework, the user also needs to obtain and enter API keys in the user settings that is used in the project.
- VirusTotals API key is obtained by creating an account on VirusTotal.com.
- MalwareBazaars API key is obtained by creating an account on Abuse.ch.

For complete instructions about running and modifying the framework, please refer to the written report, Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs.

Contact

For any questions about the repository or the master thesis contact [email protected].

Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs

Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs

Prerequisites

Contact

Related Skills

<h1 align="center">

- Identify gaps

2. Apply Deepthink Protocol (reason about dependencies

Automated Reproducible Malware Analysis: A Standardized Testbed for Prompt-Driven LLMs

Prerequisites

Contact