Large Language Models for Malware Detection: A Systematic Review, Taxonomy, and Open Challenges

Abstract

The rapid evolution of malware targeting mobile devices, IoT/edge platforms, and traditional computing systems has intensified the need for detection techniques capable of reasoning about complex code semantics and behavioral patterns. Large Language Models (LLMs) have recently emerged as a promising direction due to their ability to encode contextual relationships that are difficult to model with traditional approaches. This topical review presents a comprehensive synthesis of LLM-driven malware detection across heterogeneous environments. Based on 26 peer-reviewed studies published between 2020 and 2025, the review introduces a unified taxonomy spanning static and behavioral embeddings, prompt-driven analyses, reasoning-enhanced architectures, and security-oriented fine-tuning strategies. A structured comparative assessment across effectiveness, robustness, computational efficiency, explainability, and privacy, reveals consistent methodological trends: fine-tuned and hybrid transformer architectures deliver the strongest empirical performance, while prompt-based and lightweight models offer practical benefits for resource-constrained platforms. The review also highlights persistent gaps, including limited adversarial-robustness evaluation, insufficient attention to privacy and governance, and a lack of standardized metrics for explainability and energy efficiency. The study concludes by outlining key research challenges and future opportunities, including scalable robustness testing, privacy-preserving LLM adaptation, lightweight architectures for constrained devices, and more rigorous human-centered explainability benchmarks. This review aims to consolidate existing knowledge and guide the development of reliable and practical LLM-driven malware detection systems.