I-MAD: Interpretable Malware Detector Using Galaxy Transformer
It addresses the problem of detecting new malware with interpretable results for computer security, representing an incremental improvement over existing machine learning methods.
The paper tackles malware detection by proposing I-MAD, an interpretable model that uses a Galaxy Transformer to understand assembly code at multiple levels and an interpretable neural network for feature impact quantification, achieving state-of-the-art accuracy in static detection.
Malware currently presents a number of serious threats to computer users. Signature-based malware detection methods are limited in detecting new malware samples that are significantly different from known ones. Therefore, machine learning-based methods have been proposed, but there are two challenges these methods face. The first is to model the full semantics behind the assembly code of malware. The second challenge is to provide interpretable results while keeping excellent detection performance. In this paper, we propose an Interpretable MAlware Detector (I-MAD) that outperforms state-of-the-art static malware detection models regarding accuracy with excellent interpretability. To improve the detection performance, I-MAD incorporates a novel network component called the Galaxy Transformer network that can understand assembly code at the basic block, function, and executable levels. It also incorporates our proposed interpretable feed-forward neural network to provide interpretations for its detection results by quantifying the impact of each feature with respect to the prediction. Experiment results show that our model significantly outperforms existing state-of-the-art static malware detection models and presents meaningful interpretations.