一句话：提出 RAML，用检索增强与 LLM 从高层行为描述出发，自动定位 Android 应用中的恶意载荷。
Android 恶意软件检测与家族分类已被广泛研究，但在已判定为恶意的样本中精确定位具体的恶意载荷仍然困难且费时。本文提出 RAML——一个受检索增强生成（RAG）启发的检索增强恶意载荷定位流水线，利用大语言模型（LLM）弥合高层行为描述与底层 Smali 代码之间的语义鸿沟。RAML 首先由 Smali 代码生成类级描述并嵌入向量数据库，通过相似度搜索进行语义检索；随后借助 LLM 对候选结果重排序，并在方法级进行 LLM 分析，精确识别恶意方法并给出可解释的角色说明。初步结果表明，RAML 能依据行为描述有效定位相应恶意载荷，缩小分析范围并减少人工投入，为自动化恶意软件取证提供了有前景的方向。
Android malware detection and family classification have been extensively studied, yet localizing the exact malicious payloads within a detected sample remains a challenging and labor-intensive task. We propose RAML, a novel Retrieval-Augmented Malicious payload Localization pipeline inspired by retrieval-augmented generation (RAG), which leverages large language models (LLMs) to bridge high-level behavior descriptions and low-level Smali code. RAML generates class-level descriptions from Smali code, embeds them into a vector database, and performs semantic retrieval via similarity search. Matched candidates are re-ranked with LLM assistance, followed by method-level LLM analysis to precisely identify malicious methods and provide insightful role explanations. Preliminary results show that RAML effectively localizes corresponding malicious payloads based on behavioral descriptions, narrows the analysis scope, and reduces manual effort—offering a promising direction for automated malware forensics.
@inproceedings{paperbot9261,
title = {RAML: Toward Retrieval-Augmented Localization of Malicious Payloads in Android Apps},
author = {Tiezhu Sun and Marco Alecci and Yewei Song and Xunzhu Tang and Kisub Kim and Jordan Samhi and Tegawendé F. Bissyandé and Jacques Klein},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00351}
}