让专家混合模型的决策更透明,揭示恶意软件检测中各专家的贡献。
Routing-Aware Explanations for Mixture of Experts Graph Models in Malware Detection
- 通过多统计量节点编码与六种专家组合,增强图结构表征多样性。
- 在CFG数据集上达到高检测准确率,且扰动下解释稳定可靠。
- 生成基于路由门控的细粒度归因,适合安全分析与模型可解释性研究。
Mixture-of-Experts (MoE) 通过学习路由机制融合图的多个视角,实现灵活的图推理。本文针对恶意软件检测中的控制流图(CFG),提出路由感知的解释方法。架构在两个层面构建多样性:节点层上,每层计算多种邻域统计量,并通过MLP融合,受度重加权因子rho和池化方式lambda(mean/std/max)调控,生成捕捉互补结构线索的节点表示;读出层上,六个专家分别对应特定的(rho, lambda)视图,输出图级逻辑值,由路由器加权整合为最终预测。事后解释通过每个专家的边级归因并按路由门控聚合生成,使理由同时反映各专家关注点及其被选中的强度。在相同CFG数据集上对比GCN、GIN、GAT等单专家GNN基线,所提MoE实现优异检测精度,并在基于稀疏性的扰动下保持稳定的忠实归因。结果表明,显式建模路由机制,结合多统计量节点编码与专家级多样性,可显著提升MoE在恶意软件分析中的可解释性。
原文摘要 · Abstract (English)
Mixture-of-Experts (MoE) offers flexible graph reasoning by combining multiple views of a graph through a learned router. We investigate routing-aware explanations for MoE graph models in malware detection using control flow graphs (CFGs). Our architecture builds diversity at two levels. At the node level, each layer computes multiple neighborhood statistics and fuses them with an MLP, guided by a degree reweighting factor rho and a pooling choice lambda in {mean, std, max}, producing distinct node representations that capture complementary structural cues in CFGs. At the readout level, six experts, each tied to a specific (rho, lambda) view, output graph-level logits that the router weights into a final prediction. Post-hoc explanations are generated with edge-level attributions per expert and aggregated using the router gates so the rationale reflects both what each expert highlights and how strongly it is selected. Evaluated against single-expert GNN baselines such as GCN, GIN, and GAT on the same CFG dataset, the proposed MoE achieves strong detection accuracy while yielding stable, faithful attributions under sparsity-based perturbations. The results indicate that making the router explicit and combining multi-statistic node encoding with expert-level diversity can improve the transparency of MoE decisions for malware analysis.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。