MalDEX: An Explainable Malware Detection System Based on Ensemble Learning

Ensuring the security of information systems in the modern technology era is a critical requirement due to the increasing complexity and volume of malicious codes and threats. However, traditional signature-based approaches for malware detection suffer from limitations in identifying unknown malware, susceptibility to adversarial samples, and suboptimal performance. To overcome these challenges, leveraging Artificial Intelligence (AI) and Machine Learning (ML) in malware detection has emerged as a promising avenue for enhancing the accuracy and effectiveness of defense systems. This study introduces MalDEX, a novel Explainable black-box malware detection system. MalDEX leverages attribute extraction from Windows Portable Executable (PE) files and employs a range of classifiers, including Single Algorithms, Homogeneous Ensemble Algorithms, and Heterogeneous Ensemble Algorithms, to determine the presence of malware. To evaluate the models’ quality and address interpretability concerns, we adopt the Kernel SHAP method. This method facilitates a comprehensive interpretation of the ML model’s decision-making process by examining the input’s contribution to decoding repetitive expectations. The experimental results demonstrate that the proposed system exhibits robust classification capabilities while providing descriptive visualizations and explanations elucidating the impact of features on prediction outcomes.