A Large Language Model Approach to Generating Bypass Rules for Malware Evasion in Analysis Sandbox

Computer Science > Cryptography and Security [Submitted on 20 May 2026] A Large Language Model Approach to Generating Bypass Rules for Malware Evasion in Analysis Sandbox Zhiyong Sui, Lamine Noureddine, Mst Eshita Khatun, Sideeq Bello, Justin Woodring, Aisha Ali-Gombe Sandbox evasion remains a critical challenge for automated malware analysis, as modern malware employs environment checks to detect analysis platforms and suppress malicious behavior. Existing approaches rely on manually crafted bypass rules that require deep reverse engineering of each evasion mechanism -an approach that cannot scale against rapidly evolving evasion techniques. In this paper, we leverage large language models (LLMs) to automatically generate YARA rules that bypass evasion checks in sandbox environments. We propose ABLE, which analyzes execution traces from malware terminated due to potentially evasive behavior and employs multiple reasoning strategies to generate targeted bypass rules. To address syntactic errors and improve the efficacy of the bypass rules in the LLM outputs, we introduce an auto-sanitization pipeline and feedback-driven iterative refinement. We evaluate ABLE on 334 real-world malware samples across four open-weight LLMs. ABLE achieves a 79% bypass success rate, with iterative refinement contributing 29.5% of successful cases. Compared to existing analysis platforms, ABLE identifies 47% more malware family classifications and exposes previously hidden behaviors. Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2605.21821 [cs.CR]   (or arXiv:2605.21821v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2605.21821 Focus to learn more Submission history From: Aisha Ali-Gombe [view email] [v1] Wed, 20 May 2026 23:43:02 UTC (254 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-05 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)