通过子图匹配实现恶意软件检测的双层可解释分析
Dual Explanations via Subgraph Matching for Malware Detection
- 用子图匹配技术构建第二层解释器，关联已知行为模式
- 在保持高检测性能前提下，显著提升解释可读性
- 适合需要理解恶意行为机制的安全研究者
可解释的恶意软件检测对于理解有害行为、建立自动化安全系统的信任至关重要。传统图神经网络（GNN）的可解释方法虽能识别图中重要区域，但难以将其与已知的良性或恶意行为模式关联，限制了其在安全场景中的应用。本文提出一种新型双原型驱动的可解释框架，结合基础解释器与基于子图匹配的新二级解释器（SubMatch解释器）。该方法根据节点与匹配子图的关联程度分配可解释得分，实现对良性与恶意区域的细粒度区分。原型引导的评分机制使解释更直观且符合实际行为模式。实验表明，该方法在保持高检测性能的同时，显著提升了恶意软件分析中的可解释性。
原文摘要 · Abstract (English)
Interpretable malware detection is crucial for understanding harmful behaviors and building trust in automated security systems. Traditional explainable methods for Graph Neural Networks (GNNs) often highlight important regions within a graph but fail to associate them with known benign or malicious behavioral patterns. This limitation reduces their utility in security contexts, where alignment with verified prototypes is essential. In this work, we introduce a novel dual prototype-driven explainable framework that interprets GNN-based malware detection decisions. This dual explainable framework integrates a base explainer (a state-of-the-art explainer) with a novel second-level explainer which is designed by subgraph matching technique, called SubMatch explainer. The proposed explainer assigns interpretable scores to nodes based on their association with matched subgraphs, offering a fine-grained distinction between benign and malicious regions. This prototype-guided scoring mechanism enables more interpretable, behavior-aligned explanations. Experimental results demonstrate that our method preserves high detection performance while significantly improving interpretability in malware analysis.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。