LeoDroid: An LLM-Based Few-Shot Multi-Label Detection for Android Malware

Data noise poses a fundamental challenge in Android malware detection that significantly degrades the performance of machine learning models. Traditional approaches using third-party services like VirusTotal introduce inconsistencies from malware evolution and temporal label variations, while deep learning methods struggle with noisy data due to their reliance on large clean datasets and their tendency to memorize rather than generalize from noisy labels. To address these challenges, we propose the LLM-based Few-shot Multi-Label Malware Detection (LeoDroid), a novel framework that enhances malware detection robustness in both noisy and data-scarce environments, which are enabled by Large Language Models (LLMs). Our approach employs a two-stage process that integrates a core-set strategy for selecting representative samples with a carefully designed prompt engineering methodology. The prompt design combines label descriptions, core-set examples, and chain-of-thought reasoning to guide large language models in multi-label classification tasks. Through this integration, LeoDroid effectively manages the balance between sample size and noise tolerance to maintain high detection accuracy. We evaluate our framework on three real-world datasets-anonymousCERT, Drebin, and VirusShare. The experimental results demonstrate exceptional performance with an MS-ACC above 0.93 across all datasets, surpassing traditional machine learning methods by more than three times on the anonymousCERT.