Efficient Code Analysis via Graph Representation Learning-Guided Large Language Models

Large Language Models (LLMs) have significantly advanced code analysis tasks, yet they struggle to detect malicious behaviors fragmented across files, whose intricate dependencies easily get lost in the vast amount of benign code. We therefore propose a graph-centric attention acquisition pipeline that enhances LLMs' ability to localize malicious behavior. The approach parses a project into a code graph, uses an LLM to encode nodes with semantic and structural signals, and trains a Graph Neural Network (GNN) under sparse supervision. The GNN performs an initial detection, and by interpreting these predictions, identifies key code sections that are most likely to contain malicious behavior. These influential regions are then used to guide the LLM's attention for in-depth analysis. This strategy significantly reduces interference from irrelevant context while maintaining low annotation costs. Extensive experiments show that the method consistently outperforms existing approaches on multiple public and custom datasets, highlighting its potential for practical deployment in software security scenarios. Codes can be found in https://github.com/Epiphaniespt/GMLLM.git.

Large Language Models have demonstrated impressive capabilities in understanding and generating computer programming code. However, these advanced models face significant difficulties when tasked with identifying hidden malicious behaviors within large-scale software projects. The primary challenge stems from the models struggling to focus on complex and fragmented malicious instructions that are easily lost amidst vast amounts of safe code. Processing entire software packages with these large models also consumes an impractical amount of computational resources. To overcome these limitations, this research introduces a novel detection framework designed to guide the attention of Large Language Models toward the most critical sections of a software project. The proposed approach first translates the software code into a structural map to represent the relationships between different programming elements. A specialized and highly efficient neural network is then trained using minimal data to scan this structural map and pinpoint the specific regions most likely to contain harmful instructions. By isolating these highly suspicious areas, the system directs the Large Language Model to perform a deep and focused analysis only where it is necessary. This targeted strategy prevents the advanced models from being overwhelmed by irrelevant safe code and significantly reduces the computational costs associated with large-scale analysis. Extensive testing demonstrates that this guided approach consistently outperforms both standard Large Language Models and traditional detection tools in identifying malicious Python software. Furthermore, the framework maintains the ability to provide detailed and readable explanations of the identified security threats. This research highlights a practical and cost-effective pathway for deploying advanced artificial intelligence in real-world software security environments.