CyberAI: An Advanced Malware Analysis Framework Powered by Agentic AI and Autonomous Tool Orchestration.

Abstract

The modern cybersecurity landscape is defined by asymmetric warfare. Advanced threat actors increasingly leverage automated generation tools, polymorphic code, and sophisticated evasion techniques to orchestrate large-scale campaigns. Consequently, Security Operations Centers (SOCs) remain fundamentally bottlenecked by time-intensive manual triage, severe alert fatigue, and a critical scarcity of highly specialized reverse engineers. To address this structural imbalance, we present CyberAI: an advanced Agentic Artificial Intelligence framework engineered to operate as a virtual, fully autonomous SOC analyst. Transcending the limitations of passive diagnostic sandboxes, CyberAI inherently possesses the cognitive capacity to reason, formulate hypotheses, and autonomously orchestrate over 129 specialized forensic utilities within an isolated Linux execution environment. Driven by a robust ReAct (Reason + Act) engine and seamlessly integrated with disassemblers via the Model Context Protocol (MCP), the framework conducts deep, interactive code-level inspection without human prompting. Rigorous empirical evaluations, including System Usability Scale (SUS) assessments conducted by Level 2 and Level 3 malware analysts, yielded unprecedented operational gains. The framework demonstrated a paradigm-shifting 95% reduction in time-to-triage and a 99% decrease in analytical data noise. Ultimately, CyberAI fundamentally alters the economics of cyber defense, establishing a scalable blueprint for human-machine teaming in incident response.