mlsanityData to 14 Oct 2026

On the Consistency of GNN Explanations for Malware Detection

arXiv 2504.16316 ↗First posted 22 Apr 2025cs.CR cs.AI cs.LGcited by 5

Not on the map. Why?

Abstract (arXiv)

Control Flow Graphs (CFGs) are critical for analyzing program execution and characterizing malware behavior. With the growing adoption of Graph Neural Networks (GNNs), CFG-based representations have proven highly effective for malware detection. This study proposes a novel framework that dynamically constructs CFGs and embeds node features using a hybrid approach combining rule-based encoding and autoencoder-based embedding. A GNN-based classifier is then constructed to detect malicious behavior from the resulting graph representations. To improve model interpretability, we apply state-of-the-art explainability techniques, including GNNExplainer, PGExplainer, and CaptumExplainer, the latter is utilized three attribution methods: Integrated Gradients, Guided Backpropagation, and Saliency. In addition, we introduce a novel aggregation method, called RankFusion, that integrates the outputs of the top-performing explainers to enhance the explanation quality. We also evaluate explanations using two subgraph extraction strategies, including the proposed Greedy Edge-wise Composition (GEC) method for improved structural coherence. A comprehensive evaluation using accuracy, fidelity, and consistency metrics demonstrates the effectiveness of the proposed framework in terms of accurate identification of malware samples and generating reliable and interpretable explanations.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Builds on 9 of its 44 references that are in the map. First posted on arXiv 22 Apr 2025.

Builds on

9 of 44 references.

References · 9

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  2. 2017Graph Attention Networkscited by 8,923
  3. 2017Inductive Representation Learning on Large Graphscited by 6,320
  4. 2018How Powerful are Graph Neural Networks?cited by 4,393
  5. 2019GNNExplainer: Generating Explanations for Graph Neural Networkscited by 737
  6. 2020Parameterized Explainer for Graph Neural Networkcited by 426
  7. 2021On Explainability of Graph Neural Networks via Subgraph Explorationscited by 281
  8. 2025Recent Advances in Malware Detection: Graph Learning and Explainabilitycited by 7
  9. 2024CNN-LSTM and Transfer Learning Models for Malware Classification based on Opcodes and API Callscited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 3.

5 papers.

  1. 2025Dual Explanations via Subgraph Matching for Malware Detectioncited by 2
  2. 2025Explainable Attention-Guided Stacked Graph Neural Networks for Malware Detectioncited by 2
  3. 2026Routing-Aware Explanations for Mixture of Experts Graph Models in Malware Detectioncited by 0
  4. 2026Explainability-Guided Adversarial Attacks on Transformer-Based Malware Detectors Using Control Flow Graphscited by 0
  5. 2026Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detectioncited by 0