# Learning Explainable Representations of Malware Behavior

arXiv: https://arxiv.org/abs/2106.12328 · HTML: https://mlsanity.com/paper/2106.12328/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 37 references that are in the map.
- First posted on arXiv 23 Jun 2021.

## Builds on (most cited first, 11 of 11)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Axiomatic Attribution for Deep Networks](https://mlsanity.com/paper/1703.01365/) (2017)
- [Self-Attention with Relative Position Representations](https://mlsanity.com/paper/1803.02155/) (2018)
- [Convolutional Sequence to Sequence Learning](https://mlsanity.com/paper/1705.03122/) (2017)
- [Not Just a Black Box: Learning Important Features Through Propagating Activation Differences](https://mlsanity.com/paper/1605.01713/) (2016)
- [Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection](https://mlsanity.com/paper/1704.08996/) (2017)
- [eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys](https://mlsanity.com/paper/1702.08568/) (2017)
- [Discriminative models for multi-instance problems with tree-structure](https://mlsanity.com/paper/1703.02868/) (2017)
- [Joint Detection of Malicious Domains and Infected Clients](https://mlsanity.com/paper/1906.09084/) (2019)

## Built on by (most cited first, 2 of 2)

- [Backdooring Explainable Machine Learning](https://mlsanity.com/paper/2204.09498/) (2022)
- [Tiny Enough to Break In: Agentic Remote Access Trojans Powered by Small Language Models](https://mlsanity.com/paper/2608.03009/) (2026)

## Abstract (arXiv)

We address the problems of identifying malware in network telemetry logs and providing indicators of compromise -- comprehensible explanations of behavioral patterns that identify the threat. In our system, an array of specialized detectors abstracts network-flow data into comprehensible network events in a first step. We develop a neural network that processes this sequence of events and identifies specific threats, malware families and broad categories of malware. We then use the integrated-gradients method to highlight events that jointly constitute the characteristic behavioral pattern of the threat. We compare network architectures based on CNNs, LSTMs, and transformers, and explore the efficacy of unsupervised pre-training experimentally on large-scale telemetry data. We demonstrate how this system detects njRAT and other malware based on behavioral patterns.