LLMs beat handcrafted rules in Android obfuscation detection study
Researchers tested multiple LLMs on obfuscated Android code—results challenge traditional SAST tools.
Deep Dive
A new empirical study by Ferrari, Alecci, and colleagues evaluates whether off-the-shelf LLMs can detect obfuscation in Android apps without handcrafted heuristics. Testing on a controlled benchmark and real-world Google Play apps, the researchers compared several open-weight and proprietary LLMs against traditional SAST-based approaches. The study examines prompt design, model selection, and decision thresholds, and compares LLM-based reasoning with existing SAST-based obfuscation-detection approaches.
Key Points
- Evaluated multiple open-weight and proprietary LLMs on both a controlled obfuscated benchmark and real Google Play apps.
- LLMs achieved competitive obfuscation detection without handcrafted heuristics, outperforming traditional SAST tools in several cases.
- Prompt design and model selection significantly impact accuracy; the study provides thresholds and best practices for deployment.
Why It Matters
LLMs could change how Android security works, replacing brittle detection rules with flexible semantic reasoning.