A multi-label visualisation approach for malware behaviour analysis

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Malware Analysis

Background:

• Malware continuously evolves, challenging traditional cybersecurity defenses.
• Existing classification methods focus on primary objectives, neglecting complex, overlapping malware strategies.

Purpose of the Study:

• To introduce DECODE (DEep Classification Of Dynamic Exploits), a novel framework for interpretable and comprehensive malware analysis.
• To address limitations in conventional malware classification by incorporating multi-label, context-aware analysis.

Main Methods:

• Utilized object detection with a novel, automated annotation pipeline for malware classification.
• Extended Gradient-weighted Class Activation Mapping (Grad-CAM) with Bayesian formulation for uncertainty-aware visualization.
• Employed agent-based large language models (LLMs) with critique-and-verification loops for behavioral interpretation.

Main Results:

• Achieved multi-label classification accuracy of 0.8513 and binary classification accuracy of 0.9380.
• DECODE outperformed conventional deep learning baselines in malware classification tasks.
• Demonstrated effective classification even for visually indistinguishable malware features.

Conclusions:

• DECODE provides a richer understanding of complex malware threats by classifying based on fine-grained structural and behavioral traits.
• The framework enables comprehensive analysis by combining visual localization, multi-label scoring, and interpretable narratives.
• DECODE enhances cybersecurity by offering more accurate and detailed malware classification.