- Görüntülenme 17
- İndirme 1
-
Google Akademik
-
DOI
| Yazarlar | Sarı, Nisa Vuran Acı, Mehmet |
| Yayın Türü | Makale |
| Yayın Yılı | 2025 |
| DOI Adresi | https://doi.org/10.7717/peerj-cs.3258 |
| Yayıncı | PeerJ |
| Dergi Adı | PeerJ Computer Science |
| Konu Başlıkları | Artificial neural networks Artificial Intelligence Malware Detection Deep learning |
| İndekslenen Platformlar | Web of Science |
The increasing sophistication of evolving malware types and attack techniques has rendered traditional antivirus solutions inadequate, particularly in mitigating zero-day threats. To address this challenge, Machine Learning (ML) and Deep Learning (DL)-based approaches have been developed, demonstrating significant efficacy and high accuracy in malware classification. However, the black box nature of these models raises significant concerns in terms of transparency and interpretability. This study presents a comprehensive evaluation of Ensemble Learning and Deep Learning methods for static analysis-based malware classification, which allows joint analysis of Application Programming Interface (API) calls and Dynamic Link Library (DLL) data. In the study, a specially designed Convolutional Neural Network (CNN)-Gated Recurrent Units (GRU)-3 model is trained using a tailored dataset consisting of malicious and secure software. In order to better understand the model’s performance, feature importance analysis was performed using SHapley additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) Explainable Artificial Intelligence (XAI) techniques and the reliability of model decisions was increased. The proposed model was compared with DL models such as CNN, Long Short-Term Memory (LSTM), and GRU, as well as traditional ML algorithms such as Extreme Gradient Boosting (XGB), Extra Trees Classifier (ETC), K-Nearest Neighbor (KNN), and Random Forest (RF). While the traditional XGB model achieved the highest overall performance with a 99.81% accuracy rate, our proposed CNN-GRU-3 model demonstrated the best performance among all DL models, reaching a 99.37% accuracy rate. This study presents a powerful framework that provides both high accuracy in malware detection and makes the decision mechanism more transparent.
- Fakülteler
- Mühendislik Fakültesi
- Bilgisayar Mühendisliği Bölümü
|
Eser Adı dc.title |
A hybrid CNN-GRU model with XAI-Driven interpretability using LIME and SHAP for static analysis in malware detection |
|---|---|
|
Yazarlar dc.contributor.author |
Sarı, Nisa Vuran |
|
Yazarlar dc.contributor.author |
Acı, Mehmet |
|
Yayıncı dc.publisher |
PeerJ |
|
Yayın Türü dc.type |
Makale |
|
Özet dc.description.abstract |
The increasing sophistication of evolving malware types and attack techniques has rendered traditional antivirus solutions inadequate, particularly in mitigating zero-day threats. To address this challenge, Machine Learning (ML) and Deep Learning (DL)-based approaches have been developed, demonstrating significant efficacy and high accuracy in malware classification. However, the black box nature of these models raises significant concerns in terms of transparency and interpretability. This study presents a comprehensive evaluation of Ensemble Learning and Deep Learning methods for static analysis-based malware classification, which allows joint analysis of Application Programming Interface (API) calls and Dynamic Link Library (DLL) data. In the study, a specially designed Convolutional Neural Network (CNN)-Gated Recurrent Units (GRU)-3 model is trained using a tailored dataset consisting of malicious and secure software. In order to better understand the model’s performance, feature importance analysis was performed using SHapley additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) Explainable Artificial Intelligence (XAI) techniques and the reliability of model decisions was increased. The proposed model was compared with DL models such as CNN, Long Short-Term Memory (LSTM), and GRU, as well as traditional ML algorithms such as Extreme Gradient Boosting (XGB), Extra Trees Classifier (ETC), K-Nearest Neighbor (KNN), and Random Forest (RF). While the traditional XGB model achieved the highest overall performance with a 99.81% accuracy rate, our proposed CNN-GRU-3 model demonstrated the best performance among all DL models, reaching a 99.37% accuracy rate. This study presents a powerful framework that provides both high accuracy in malware detection and makes the decision mechanism more transparent. |
|
Kayıt Giriş Tarihi dc.date.accessioned |
2025-12-22 |
|
Yayın Yılı dc.date.issued |
2025 |
|
Açık Erișim Tarihi dc.date.available |
2025-12-22 |
|
Dil dc.language.iso |
eng |
|
Konu Başlıkları dc.subject |
Artificial neural networks |
|
Konu Başlıkları dc.subject |
Artificial Intelligence |
|
Konu Başlıkları dc.subject |
Malware Detection |
|
Konu Başlıkları dc.subject |
Deep learning |
|
Atıf İçin Künye dc.identifier.citation |
Sarı, N. V., & Acı, M. (2025). A hybrid CNN-GRU model with XAI-Driven interpretability using LIME and SHAP for static analysis in malware detection. PeerJ Computer Science, 11, e3258. |
|
ISSN dc.identifier.issn |
2376-5992 |
|
İlk Sayfa dc.identifier.startpage |
1 |
|
Son Sayfa dc.identifier.endpage |
32 |
|
Dergi Adı dc.relation.journal |
PeerJ Computer Science |
|
Dergi Sayısı dc.identifier.issue |
3258 |
|
Dergi Cilt dc.identifier.volume |
11 |
|
DOI Numarası dc.identifier.doi |
https://doi.org/10.7717/peerj-cs.3258 |
|
İndekslenen Platformlar dc.source.database |
Web of Science |
-
PDF