APPLICATION OF EXPLAINABLE AI METHODS TO IMPROVE THE INTERPRETABILITY OF MALWARE DETECTION SYSTEMS

Ruslan Edeev

2026

Full text Open access: Hybrid Metadata (CSL-JSON)

DOI 10.51885/3107-2755_jisc_2026_1_1

Data confidence 70 medium

How this score is calculated

It is built from checkable properties of the record itself: whether the article has a DOI, how many independent sources confirmed its data, whether the required fields are filled in, and how recent the latest confirmation is. Disagreement between sources and a missing identifier lower it. A value of 80 or above means the record was published without further checking; 60 to 79 means it is published at reduced confidence, with a manual check advisable. A record verified by an editor by hand is never pushed below 90 by a recalculation. This scores our data about the article, not the article itself.

Abstract

Machine learning–based malware detection systems achieve high accuracy but often lack transparency, limiting their trustworthiness in cybersecurity operations. This study presents an interpretable malware detection framework that integrates a LightGBM classifier trained on the EMBER dataset with SHAP-based Explainable AI (XAI) techniques. Unlike prior works that apply explainability only post hoc, our framework embeds interpretability directly into the model pipeline without compromising predictive performance. The model achieved 97.35% accuracy and a ROC-AUC of 0.9963, confirming its high discriminative capability. SHAP analysis identified key influential features such as file entropy, import table size, and suspicious API usage, improving transparency in automated malware analysis and supporting more reliable decision-making in cybersecurity environments.