•  
  •  
 

Abstract

This paper presents an end-to-end, explainable malware triage pipeline designed for defense-oriented cyber operations. It combines high-performance static detection methods with analyst-centered interpretability. Utilizing the EMBER 2024 Windows PE subset, we train and evaluate four classifiers and select LightGBM as the production model based on its predictive performance, inference efficiency, and compatibility with exact tree-based attribution. The deployed system consists of four sequential components: PE feature extraction, malware probability scoring, dual explainability (using SHAP and LIME), and large language model (LLM) report generation, all integrated within a Flask web interface. On a temporal test set of 1,080,000 samples, LightGBM achieves an accuracy of 96.17% and an ROC-AUC of 0.9943, outperforming baseline models such as Random Forest, Logistic Regression, and Linear SVM. Additionally, on a 6,315-sample evasive challenge set, it maintains a 71.77% detection rate against binaries that previously evaded detection by many commercial antivirus engines. To enhance analyst trust, the framework introduces a dual explainable AI (XAI) consensus strategy. This strategy interprets agreement between SHAP and LIME outputs as a confidence signal, while disagreement indicates uncertainty that requires further investigation. The LLM translates the structured attribution outputs into concise, evidence-based incident narratives, reducing the interpretation burden on analysts while maintaining traceability to the model features. The resulting prototype demonstrates that explainability and operational utility can be effectively optimized together. Decisions remain auditable, confidence levels are better calibrated, and outputs become more actionable for security analysts.

DOI

https://doi.org/10.5038/2378-0789.9.1.1153

Download

Share

COinS