Learning Explainable Malware Characterization Using Knowledge Base Embedding

Malware detection is critical in cybersecurity, yet traditional signature-based methods often fail against emerging threats. Recent advancements suggest machine learning models can enhance malware classification accuracy; however, these models frequently lack explainability, limiting the insights they provide to cybersecurity experts. In this work, we introduce a novel approach using knowledge base embedding to classify malware while also delivering interpretable explanations. By learning vector representations for entities and relationships within a knowledge base, our method preserves semantic meaning, effectively distinguishing between malicious and benign software. Leveraging the RotatE model, our approach achieves 80% classification accuracy and generates meaningful, human-understandable explanations of model decisions, offering insights into malware behavior and improving transparency in detection and characterization.