Dual Explanations via Subgraph Matching for Malware Detection

2025-04-29

AI Summary

Traditional GNN interpretability methods merely localize salient subgraphs without semantic alignment to known benign or malicious behavioral patterns, limiting their practical utility in security applications. To address this, we propose a novel two-level prototype-driven explanation framework that introduces subgraph matching (SubMatch) into the GNN interpretation pipeline for the first time. It comprises a baseline interpreter and a second-level behavior-prototype-aligned interpreter, enabling fine-grained, semantically interpretable node-level attribution. Our method explicitly grounds detection decisions in empirically validated benign/malicious behavioral subgraph prototypes, jointly optimizing detection accuracy and explanation fidelity. Evaluated on multiple malware graph datasets, our approach improves explanation quality by over 35% compared to state-of-the-art methods, significantly enhancing security analysts’ trust and operational utility.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Computer Vision: Interpretability, Explainability, and Transparency
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models

Application Category

• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs
• Security and Privacy: Data transparency and provenance
• Semantics and Knowledge: Methods, algorithms and applications for the development of semantic models, knowledge graphs and other forms of structured data models with machine-interpretable semantics

Abstract

Interpretable malware detection is crucial for understanding harmful behaviors and building trust in automated security systems. Traditional explainable methods for Graph Neural Networks (GNNs) often highlight important regions within a graph but fail to associate them with known benign or malicious behavioral patterns. This limitation reduces their utility in security contexts, where alignment with verified prototypes is essential. In this work, we introduce a novel dual prototype-driven explainable framework that interprets GNN-based malware detection decisions. This dual explainable framework integrates a base explainer (a state-of-the-art explainer) with a novel second-level explainer which is designed by subgraph matching technique, called SubMatch explainer. The proposed explainer assigns interpretable scores to nodes based on their association with matched subgraphs, offering a fine-grained distinction between benign and malicious regions. This prototype-guided scoring mechanism enables more interpretable, behavior-aligned explanations. Experimental results demonstrate that our method preserves high detection performance while significantly improving interpretability in malware analysis.

Problem

• Enhancing interpretability in GNN-based malware detection
• Linking detected regions to known malicious/benign patterns
• Improving explanation alignment with verified behavioral prototypes

Innovation

• Dual prototype-driven explainable framework for GNNs
• Subgraph matching technique for fine-grained distinction
• Prototype-guided scoring for behavior-aligned explanations