Advancing Malware Detection Using Memory Analysis and Explainable AI Approach

Abstract

Malware detection is a critical challenge in cybersecurity, exacerbated by the continuous evolution of malicious software. Traditional security measures often fail to detect obfuscated malware that uses advanced evasion techniques. This research explores the combination of memory analysis techniques with machine learning (ML) and deep learning (DL) algorithms, enhanced by Explainable AI (XAI), to improve malware detection and classification. Using a curated dataset for memory analysis, algorithms like Random Forest, XGBoost, Logistic Regression, LSTM, GRU, ANN, and hybrid models were used for multiclass classification. Ensemble methods, particularly Random Forest and XGBoost, proved effective, with Random Forest achieving 87.30% accuracy. The integration of GRU and LSTM within hybrid models showed promising results, highlighting the benefits of combining different neural network architectures. Explainable AI techniques such as LIME provided insights into the features and decision criteria influencing classification, enhancing model interpretability and transparency. This research significantly advances malware detection, offering practical implications for real-world cybersecurity.