Abstract: Malware detection and classification face challenges due to their complexity and stealthiness.Although GNNs can effectively model control flow graphs,thereby enhancing the accuracy of behavioral pattern recognition,their “black-box” nature limits interpretability.Moreover,existing methods rely heavily on large amounts of labeled data,resulting in weaker generalization capabilities and difficulties in addressing novel malware.LLMs possess strong feature extraction and contextual understanding abilities,capable of efficiently processing few-shot data and achieving multimodal information fusion,thus enhancing analytical precision and generalizability.Inspired by large language models and leveraging contrastive learning strategies,this paper aims to simultaneously learn the structure of control flow graphs and assembly instructions,thereby enhancing the effectiveness and flexibility of malware analysis.Based on this,this paper designs the Instruct-Malware framework,which employs lightweight graph-text alignment projection and two-stage instruction optimization,significantly enhancing the flexibility and robustness of malware analysis.Additionally,the interpretability of the model has been improved,clarifying the decision-makingprocess.Experimental results demonstrate that the proposed framework exhibits significant performance improvements in malware classification and subgraph recognition tasks,surpassing current mainstream approaches and substantially narrowing the gap with specialized mo-dels.This provides new insights into building an efficient and reliable malware analysis system.

Key words: Malware analysis, Graph neural networks, Large language models, Contrastive learning