Explaining the Effectiveness of Machine Learning in Malware Detection: Insights from Explainable AI
Hendrio Luis de Souza Bragança, Vanderson da Silva Rocha, Eduardo Souto, Diego Kreutz, Eduardo Luzeiro Feitosa · 2023
We use Explainable Artificial Intelligence (XAI) to understand and assess the decisions made by ML models in Android malware detection. To evaluate malware detection, we conducted experiments using seven datasets. Our findings indicate that it is possible to accurately identify malware across multiple datasets. However, each dataset may have a different collection of features available. We also discuss the implications of incorporating expert-dependent features into the malware detection procedure. Such features have the potential to increase model accuracy by detecting minor indicators of harmful behaviour that automated algorithms may miss. However, because of the necessity for in-depth manual analysis, this strategy increases the resource and time requirements. It also risks adding human bias into the models and raises scaling issues in the continuously developing Android application landscape. Our results suggest that XAI techniques should be used to help malware analysis researchers understand how ML models work, rather than only concentrating on increasing accuracy.