Home / Current Issue / Paper 1710529
Explainable Deep Neural Networks for Real-Time Malware Classification in Enterprise Systems
Subject area: Science,Engineering and Technology · Area of research: Cyber Security
DOI: 10.64388/IREV9I3-1710529-439
Abstract
The rise and growing complexity of malware present a serious and ongoing threat to enterprise systems. Traditional methods that rely on signatures for detection just aren't cutting it anymore when it comes to dealing with polymorphic and zero-day threats. Enter deep neural networks (DNNs), which have proven to be a robust solution, boasting high accuracy and the capability to identify new malware variants by learning intricate patterns from extensive datasets. However, their "black-box" nature?meaning we can't easily understand how they make decisions?can be a barrier to their use in critical enterprise security situations. This paper introduces a thorough framework for real-time malware classification using explainable deep neural networks (XDNNs) tailored for enterprise environments. We suggest an architecture that combines a high-performance deep learning model with post-hoc explainability techniques like SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME). Our method analyzes both static and dynamic malware features to achieve impressive detection accuracy while also giving security analysts valuable insights into the model's decision-making process. We assess the trade-offs between model performance, computational demands, and the clarity of explanations, showing that XDNNs can strike a crucial balance between effectiveness and interpretability, ultimately fostering trust and enhancing the operational efficiency of a security operations center (SOC).
Keywords
Explainable AI (XAI), Deep Learning, Deep Neural Networks (DNNs), Malware Classification, Real-time Malware Detection, Enterprise Security, Cybersecurity.
References
[1] Ö. A. Aslan and R. Samet, "A Comprehensive Review on Malware Detection Approaches," IEEE Access, vol. 8, no. 1, pp. 6249-6271, 2020.
[2] P. Čisar, S. Maravić Čisar, A. Pásztor, T. A. Kovács and I. Fürstner, "Application of Heuristic Scanning in Malware Detection," in Critical Infrastructure Protection: Advanced Technologies for Crisis Prevention and Response (NATO ATC 2024), Netherlands, 2024.
[3] G. Nguyen, B. M. Nguyen, D. Tran and L. Hluchy, "A heuristics approach to mine behavioural data logs in mobile malware detection system," Data & Knowledge Engineering, vol. 115, no. 1, pp. 129-151, May 2018.
[4] A. Afianian, S. Niksefat, B. Sadeghiyan and D. Baptiste, "Malware dynamic analysis evasion techniques: A survey," ACM Computing Surveys (CSUR), vol. 52, no. 6, pp. 1-28, 2019.
[5] K. Lee, J. Lee and K. Yim, "Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack," Applied Sciences, vol. 13, no. 5, p. 2894, 2023.
[6] S. A. Roseline, S. Geetha, S. Kadry and Y. Nam, "Intelligent Vision-Based Malware Detection and Classification Using Deep Random Forest Paradigm," IEEE Access, vol. 8, no. 1, pp. 206303-206324, 2020.
[7] D. Vasan, M. Alazab, S. Wassan, H. Naeem, B. Safaei and Q. Zheng, "IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture," Computer Networks, vol. 171, no. 1, p. 107138, April 2020.
[8] S. Shiva Darshan and C. Jaidhar, "Windows Malware Detector Using Convolutional Neural Network Based on Visualization Images," EEE Transactions on Emerging Topics in Computing, vol. 9, no. 2, pp. 1057-1069, 2021.
[9] D. Odera and G. Odiaga, "A comparative analysis of recurrent neural network and support vector machine for binary classification of spam short message service.," World Journal of Advanced Engineering Technology and Sciences, vol. 9, no. 1, pp. 127-152, May 2023.
[10] M. S. Akhtar and T. Feng, "Detection of Malware by Deep Learning as CNN-LSTM Machine Learning Techniques in Real Time," Symmetry, vol. 14, no. 11, p. 2308, November 2022.
How to cite this paper
@article{1710529,
author = {Dr. Deepak Tomar, Dr. Kismat Chhillar, Prof. Alok Verma},
title = {Explainable Deep Neural Networks for Real-Time Malware Classification in Enterprise Systems},
journal = {Iconic Research And Engineering Journals},
year = {2025},
volume = {9},
number = {3},
pages = {496-502},
issn = {2456-8880},
url = {https://www.irejournals.com/formatedpaper/1710529.pdf},
abstract = {The rise and growing complexity of malware present a serious and ongoing threat to enterprise systems. Traditional methods that rely on signatures for detection just aren't cutting it anymore when it comes to dealing with polymorphic and zero-day threats. Enter deep neural networks (DNNs), which have proven to be a robust solution, boasting high accuracy and the capability to identify new malware variants by learning intricate patterns from extensive datasets. However, their "black-box" nature?meaning we can't easily understand how they make decisions?can be a barrier to their use in critical enterprise security situations. This paper introduces a thorough framework for real-time malware classification using explainable deep neural networks (XDNNs) tailored for enterprise environments. We suggest an architecture that combines a high-performance deep learning model with post-hoc explainability techniques like SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME). Our method analyzes both static and dynamic malware features to achieve impressive detection accuracy while also giving security analysts valuable insights into the model's decision-making process. We assess the trade-offs between model performance, computational demands, and the clarity of explanations, showing that XDNNs can strike a crucial balance between effectiveness and interpretability, ultimately fostering trust and enhancing the operational efficiency of a security operations center (SOC).},
keywords = {Explainable AI (XAI), Deep Learning, Deep Neural Networks (DNNs), Malware Classification, Real-time Malware Detection, Enterprise Security, Cybersecurity.},
month = {September},
doi = {https://doi.org/10.64388/IREV9I3-1710529-439}
}