← all papers · overview

An Interpretable Malware Detection Framework Based on Gradient Boosting and Explainable AI

Abstract

Malware is now a major cybersecurity threat, affecting computers, smartphones, and IoT devices. Traditional signature-based detection fails against fast-evolving mal-ware. This study presents a machine learning framework for malware detection that integrates multiple classifiers, dimensionality reduction, and explainable AI (XAI) to deliver high accuracy and interpretability. Ten supervised classifiers were evaluated Random Forest, Decision Tree, Logistic Regression, K-Nearest Neighbors, Naïve Bayes, Gradient Boosting, XGBoost, LightGBM, AdaBoost, and CatBoost using a dataset of 198,350 samples with 12 numerical features. Dimensionality reduction was applied via Principal Component Analysis (PCA) and Uniform Manifold Approximation and Projection (UMAP) to boost efficiency while retaining key information. Models were assessed using accuracy, precision, recall, F1-score, confusion matrix, and ROC-AUC. Gradient Boosting achieved the top accuracy of 99.83%, followed closely by Random Forest, Light-GBM, and CatBoost. For interpretability, LIME provided local explanations and SHAP offered global insights, identifying file size, dropped files, and network connections as the most influential malware indicators. Compared to prior work, this framework delivers superior accuracy, strong transparency, and computational efficiency, making it a reliable and practical solution for modern malware detection.

Related papers

Ranked by semantic similarity — how closely each paper's abstract matches this one (100% = near-identical topic).