PhilaeX: Explaining the Failure and Success of AI Models in Malware Detection

2022-07-02 · Zhi Lu, Vrizlynn L. L. Thing

The explanation to an AI model's prediction used to support decision making in cyber security, is of critical importance. It is especially so when the model's incorrect prediction can lead to severe damages or even losses to lives and critical assets. However, most existing AI models lack the ability to provide explanations on their prediction results, despite their strong performance in most scenarios. In this work, we propose a novel explainable AI method, called PhilaeX, that provides the heuristic means to identify the optimized subset of features to form the complete explanations of AI models' predictions. It identifies the features that lead to the model's borderline prediction, and those with positive individual contributions are extracted. The feature attributions are then quantified through the optimization of a Ridge regression model. We verify the explanation fidelity through two experiments. First, we assess our method's capability in correctly identifying the activated features in the adversarial samples of Android malwares, through the features attribution values from PhilaeX. Second, the deduction and augmentation tests, are used to assess the fidelity of the explanations. The results show that PhilaeX is able to explain different types of classifiers correctly, with higher fidelity explanations, compared to the state-of-the-arts methods such as LIME and SHAP.

📄 PDF Abstract BibTeX arXiv:2207.00740

Code (0)

등록된 구현이 없습니다.

Tasks

Decision Making Malware Detection Prediction

Methods 이 논문이 사용한 방법론

SHAP 설명 없음

LIME LIME, or Local Interpretable Model-Agnostic Explanations, is an algorithm that can explain the predictions of any classifier or regressor in a faithful way, by…

Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM

2024-11-08 · Haizhou Wang, Nanqing Luo, Xusheng Li, Peng Liu

Sandboxes and other dynamic analysis processes are prevalent in malware detection systems nowadays to enhance the capability of detecting 0-day malware. Therefore, techniques of anti-dynamic analysis (TADA) are prevalent…

Language Modeling Language Modelling Large Language Model Malware Analysis+1

Context-aware, Adaptive and Scalable Android Malware Detection through Online Learning (extended version)

2017-06-03 · Annamalai Narayanan, Mahinthan Chandramohan, Lihui Chen, Yang Liu

It is well-known that Android malware constantly evolves so as to evade detection. This causes the entire malware population to be non-stationary. Contrary to this fact, most of the prior works on Machine Learning based …

Android Malware Detection Malware Detection

FGAM:Fast Adversarial Malware Generation Method Based on Gradient Sign

2023-05-22 · Kun Li, Fan Zhang, Wei Guo

Malware detection models based on deep learning have been widely used, but recent research shows that deep learning models are vulnerable to adversarial attacks. Adversarial attacks are to deceive the deep learning model…

Deep Learning Malware Detection

The Curious Case of Machine Learning In Malware Detection

2019-05-18 · Sherif Saad, William Briguglio, Haytham Elmiligi

In this paper, we argue that machine learning techniques are not ready for malware detection in the wild. Given the current trend in malware development and the increase of unconventional malware attacks, we expect that …

BIG-bench Machine Learning Malware Analysis Malware Detection

Explaining Black-box Android Malware Detection

2018-03-09 · Marco Melis, Davide Maiorca, Battista Biggio, Giorgio Giacinto 외

Machine-learning models have been recently used for detecting malicious Android applications, reporting impressive performances on benchmark datasets, even when trained only on features statically extracted from the appl…

Android Malware Detection BIG-bench Machine Learning Malware Detection