Welcome to the LLM Obfuscation Detection repository. This project is a comprehensive research suite designed for studying, detecting, and analyzing code obfuscation techniques in Android applications (APKs), with a particular focus on those potentially enhanced, generated, or detected by Large Language Models (LLMs).
More details about this work can be found in the paper Evaluating LLMs for Obfuscation Detection and Classification in Android Apps:
@misc{ferrari2026evaluatingllmsobfuscationdetection,
title={Evaluating LLMs for Obfuscation Detection and Classification in Android Apps},
author={Luca Ferrari and Marco Alecci and Jordan Samhi and Tegawende' F. Bissyande' and Jacques Klein and Mariano Ceccato and Luca Verderame},
year={2026},
eprint={2606.14233},
archivePrefix={arXiv},
primaryClass={cs.SE},
url={https://arxiv.org/abs/2606.14233},
}
The LLMObfuscDetection project aims to provide researchers and security analysts with a robust framework for studying modern Android obfuscation. As LLMs become more capable of generating and refactoring code, the complexity and variety of obfuscation patterns are increasing. At the same time, LLMs offer new avenues for detecting these obfuscations.
This repository provides both the datasets/tools for traditional static analysis and an innovative LLM-powered detection suite.
At the root level, the repository is split into two primary modules:
| Directory | Description |
|---|---|
LLMObfuscatorDetector/ |
Python-based experimental suite that uses LLMs (OpenAI, Gemini, Ollama) to automatically detect and classify obfuscation techniques in Smali code. |
GroundTruthDataset & SAST Tools/ |
Ground-truth dataset resources and a Dockerized suite of traditional SAST (Static Application Security Testing) tools. |
Located in LLMObfuscatorDetector/, this module leverages advanced static analysis (decompilation of APKs to Smali using apktool) coupled with prompt-based LLM queries to determine:
- Obfuscation Detection: Whether a given Android application is obfuscated.
- Obfuscation Classification: What specific obfuscation techniques (e.g., Reflection, ConstStringEncryption, MethodRename, etc.) were applied.
Key Features:
- Support for multiple LLMs: OpenAI (GPT-4o), Google Gemini, and local open-source models via Ollama.
- Automated filtering of system/third-party libraries to isolate target code.
- Statistical sampling and majority-voting for robust LLM predictions.
Tip
For more details and execution instructions, please read the LLMObfuscatorDetector README.
Located in GroundTruthDataset & SAST Tools/, this module serves as the foundational data and traditional security analysis environment.
Key Components:
- Dataset: A collection of Android applications serving as the ground truth for comparative analysis (Clean vs. Obfuscated).
- Docker Suite (
docker-tools/): Integrates industry-standard SAST tools (Trueseeing, APKHunt, SEBASTiAn) into a single, automated workflow for fast, reproducible security audits.
Note
The 1,300 APK files used in the study are not hosted in this repository due to storage constraints.
Tip
For detailed instructions on setting up the Docker environment and analyzing the dataset, please refer to the Dataset & Tools README.
-
Clone the Repository:
git clone https://github.com/Mobile-IoT-Security-Lab/LLMObfuscDetection.git cd LLMObfuscDetection -
Choose Your Path:
- To experiment with LLM-based detection, navigate to
LLMObfuscatorDetector/and install the required Python dependencies. - To run traditional SAST tools on the dataset, navigate to
GroundTruthDataset & SAST Tools/docker-tools/and start the Docker environment.
- To experiment with LLM-based detection, navigate to
We welcome contributions to both the dataset and the tool suite! If you have new APKs to add, improvements to the analysis scripts, or new prompt engineering strategies for the LLM detector, please open a Pull Request.
This project is licensed under the MIT License. See the LICENSE file for more information.