Bytecode-to-Graph: Multi-Class Malware Classification via Modified Deep GCN with Explainability Overlay

This paper has presented a multi-class malware detection system that combines a modified DeeperGCN classifier with Grad-CAM-based explainability, achieving a macro-averaged F1-score of 92.1% across nine malware families on a benchmark dataset of more than 10,000 samples. The approach addresses two longstanding limitations of prior work: the inability of flat image representations to capture structural relationships within binaries, and the lack of interpretable outputs that security professionals can act on. By transforming binaries into graph structures and pairing the classifier with visual heatmaps, the system is both more accurate than CNN and standard GCN baselines and more transparent in its reasoning. The integration of both ASM-level structural features and raw byte-level data into a unified graph representation has been shown through ablation experiments to provide meaningful gains over either source alone. The HexaGuard web interface extends these capabilities to practical deployment, generating threat reports alongside heatmaps in a format accessible to analysts without specialist machine learning knowledge.

[1]        Z. Zhang, L. Yilmaz and B. Liu, “A Critical Review of Inductive Logic Programming Techniques for Explainable AI,” IEEE Trans. Neural Netw. Learn. Syst., vol. 35, no. 8, pp. 10220–10236, Aug. 2024. [2]        D. Vlahek and D. Mongus, “An Efficient Iterative Approach to Explainable Feature Learning,” IEEE Trans. Neural Netw. Learn. Syst., vol. 34, no. 5, pp. 2606–2618, May 2023. [3]        T. Zebin, S. Rezvy and Y. Luo, “An Explainable AI-Based Intrusion Detection System for DNS Over HTTPS (DoH) Attacks,” IEEE Trans. Inf. Forensics Security, vol. 17, pp. 2339–2349, 2022. [4]        S. Ali, O. Abusabha, F. Ali, M. Imran and T. Abuhmed, “Effective Multitask Deep Learning for IoT Malware Detection and Identification Using Behavioral Traffic Analysis,” IEEE Trans. Netw. Service Manag., vol. 20, no. 2, pp. 1199–1209, June 2023. [5]        S. Lai, W. Luan and J. Tao, “Explore Your Network in Minutes: A Rapid Prototyping Toolkit for Understanding Neural Networks with Visual Analytics,” IEEE Trans. Vis. Comput. Graph., vol. 30, no. 1, pp. 683–693, Jan. 2024. [6]        B. Esmaeili, A. Azmoodeh, A. Dehghantanha, H. Karimipour, B. Zolfaghari and M. Hammoudeh, “IIoT Deep Malware Threat Hunting: From Adversarial Example Detection to Adversarial Scenario Detection,” IEEE Trans. Ind. Inform., vol. 18, no. 12, pp. 8477–8486, Dec. 2022. [7]        D. Trizna, L. Demetrio, B. Biggio and F. Roli, “Nebula: Self-Attention for Dynamic Malware Analysis,” IEEE Trans. Inf. Forensics Security, vol. 19, pp. 6155–6167, 2024. [8]        S. Zillien and S. Wendzel, “Weaknesses of Popular and Recent Covert Channel Detection Methods and a Remedy,” IEEE Trans. Dependable Secure Comput., vol. 20, no. 6, pp. 5156–5167, Nov.–Dec. 2023. [9]        L. Nataraj, S. Karthikeyan, G. Jacob and B. S. Manjunath, “Malware images: Visualization and automatic classification,” in Proc. 8th Int. Symp. Visualization for Cyber Security (VizSec), 2011, pp. 1–7. [10]      R. R. Selvaraju et al., “Grad-CAM: Visual explanations from deep networks via gradient-based localization,” Int. J. Comput. Vis., vol. 128, no. 2, pp. 336–359, 2020.