Explaining Black-Box Malware Detectors: A Machine Learning Approach for Behaviour Analysis

The escalating complexity and diversity of malware threats present a significant challenge to the cybersecurity domain. Dynamic malware detection methods developed to combat these threats are often complex, black-box systems. This paper proposes a machine learning method for approximating and analyzing black-box malware detectors without privileged access, using only the malware executables and their detection outputs. Our solution leverages a pre-trained model optimized to interpret Windows API call sequences. Employing a student-teacher learning strategy, the model learns the behaviour of Windows malware detectors, requiring only samples of malicious and benign executables, along with the detector's output for each sample. We validate the effectiveness of our solution by approximating an artificial black-box detector with known behaviour patterns. Furthermore, we propose an evaluation method to compare the behaviour patterns of the black-box and student models. Our experiments demonstrate these capabilities, achieving a 95% accuracy rate approximating our artificial black-box detector with a small number of training samples.