Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Explainable Deep Learning Models for Dynamic and Online Malware Classification

Quincy Card, Daniel Simpson, Kshitiz Aryal, Maanak Gupta, Sheikh Rabiul Islam

TL;DR

This work addresses the need for interpretable malware classification in both dynamic and online execution environments. It trains FFNN and CNN models on feature sets drawn from dynamic Android and online Windows datasets, and applies SHAP, LIME, and Permutation Importance to provide global and local explanations of predictions. The study demonstrates competitive classification performance, shows the benefits of SMOTE for imbalanced data, and analyzes the computational costs and practical robustness of explanation methods in time-series contexts. The findings offer guidance for deploying real-time, interpretable malware detectors and highlight future directions, including time-series explainability and adversarial considerations.

Abstract

In recent years, there has been a significant surge in malware attacks, necessitating more advanced preventive measures and remedial strategies. While several successful AI-based malware classification approaches exist categorized into static, dynamic, or online analysis, most successful AI models lack easily interpretable decisions and explanations for their processes. Our paper aims to delve into explainable malware classification across various execution environments (such as dynamic and online), thoroughly analyzing their respective strengths, weaknesses, and commonalities. To evaluate our approach, we train Feed Forward Neural Networks (FFNN) and Convolutional Neural Networks (CNN) to classify malware based on features obtained from dynamic and online analysis environments. The feature attribution for malware classification is performed by explainability tools, SHAP, LIME and Permutation Importance. We perform a detailed evaluation of the calculated global and local explanations from the experiments, discuss limitations and, ultimately, offer recommendations for achieving a balanced approach.

Explainable Deep Learning Models for Dynamic and Online Malware Classification

TL;DR

This work addresses the need for interpretable malware classification in both dynamic and online execution environments. It trains FFNN and CNN models on feature sets drawn from dynamic Android and online Windows datasets, and applies SHAP, LIME, and Permutation Importance to provide global and local explanations of predictions. The study demonstrates competitive classification performance, shows the benefits of SMOTE for imbalanced data, and analyzes the computational costs and practical robustness of explanation methods in time-series contexts. The findings offer guidance for deploying real-time, interpretable malware detectors and highlight future directions, including time-series explainability and adversarial considerations.

Abstract

In recent years, there has been a significant surge in malware attacks, necessitating more advanced preventive measures and remedial strategies. While several successful AI-based malware classification approaches exist categorized into static, dynamic, or online analysis, most successful AI models lack easily interpretable decisions and explanations for their processes. Our paper aims to delve into explainable malware classification across various execution environments (such as dynamic and online), thoroughly analyzing their respective strengths, weaknesses, and commonalities. To evaluate our approach, we train Feed Forward Neural Networks (FFNN) and Convolutional Neural Networks (CNN) to classify malware based on features obtained from dynamic and online analysis environments. The feature attribution for malware classification is performed by explainability tools, SHAP, LIME and Permutation Importance. We perform a detailed evaluation of the calculated global and local explanations from the experiments, discuss limitations and, ultimately, offer recommendations for achieving a balanced approach.
Paper Structure (14 sections, 8 figures, 7 tables)

This paper contains 14 sections, 8 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Related Works
  3. Dynamic Analysis
  4. Online Analysis
  5. Explainable AI
  6. Methodology
  7. Dynamic Analysis
  8. Online Analysis
  9. Explainability Approach
  10. Results and Discussion
  11. Evaluation of Performance Metrics
  12. Global Explanation
  13. Local Explanation
  14. Conclusion and Future Work

Figures (8)

  • Figure 1: Performance of models in Online Analysis
  • Figure 2: Performance of models in Dynamic Analysis
  • Figure 3: A stacked bar graph depicting the top 10 online features identified by SHAP in model decision making
  • Figure 4: A stacked bar graph depicting the top 10 online features identified by SHAP in model decision making
  • Figure 5: Waterfall plots - Local interpretations of misclassified Riskware sample of dynamic data set
  • ...and 3 more figures