Malware Detection with Autonomous Agents: A Review of Functional Roles, Datasets, and Coordination Readiness

Source abstract

Large language models are increasingly written into malware detection systems, yet the literature reports them under a single label that obscures what they actually do, and existing surveys either treat agents in the abstract or malware detection without them. This review closes that gap. It is the first to examine the implemented strand of agent-based malware detection as a coordinated system rather than a catalogue of techniques, and to ask how well positioned the field is to support multi-agent operation. We make three contributions. First, we introduce a functional classification that groups each system by which of four roles the model fills, namely perception, reasoning and decision-making, adaptive monitoring, and collaborative learning, treating the mature body of standalone detectors as the foundation rather than the object of review. Second, from a corpus of recent primary studies we derive a modality-based dataset taxonomy, a map linking datasets to the role the model plays, and a pipeline-stage and role-coverage matrix for the agent-based systems. Third, we assess which existing detectors are structurally ready for agentisation and why. The analysis yields three findings. What varies across the field is not which model is used but where in the detection chain it sits. Role coverage is bimodal, with perception and reasoning served almost everywhere while adaptive monitoring is realised by a single system in the corpus and collaborative learning by none. And uniformly high reported accuracy reflects curated, single-split evaluation rather than robustness. Reading these together, the discriminating property for agentisation is whether a system exposes anything between input and verdict, which makes integration and orchestration, not the invention of new detectors, the principal open problem.