# On the Consistency of GNN Explanations for Malware Detection

arXiv: https://arxiv.org/abs/2504.16316 · HTML: https://mlsanity.com/paper/2504.16316/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 44 references that are in the map.
- First posted on arXiv 22 Apr 2025.

## Builds on (most cited first, 9 of 9)

- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [How Powerful are Graph Neural Networks?](https://mlsanity.com/paper/1810.00826/) (2018)
- [GNNExplainer: Generating Explanations for Graph Neural Networks](https://mlsanity.com/paper/1903.03894/) (2019)
- [Parameterized Explainer for Graph Neural Network](https://mlsanity.com/paper/2011.04573/) (2020)
- [On Explainability of Graph Neural Networks via Subgraph Explorations](https://mlsanity.com/paper/2102.05152/) (2021)
- [Recent Advances in Malware Detection: Graph Learning and Explainability](https://mlsanity.com/paper/2502.10556/) (2025)
- [CNN-LSTM and Transfer Learning Models for Malware Classification based on Opcodes and API Calls](https://mlsanity.com/paper/2405.02548/) (2024)

## Built on by (most cited first, 5 of 5)

- [Dual Explanations via Subgraph Matching for Malware Detection](https://mlsanity.com/paper/2504.20904/) (2025)
- [Explainable Attention-Guided Stacked Graph Neural Networks for Malware Detection](https://mlsanity.com/paper/2508.09801/) (2025)
- [Routing-Aware Explanations for Mixture of Experts Graph Models in Malware Detection](https://mlsanity.com/paper/2602.19025/) (2026)
- [Explainability-Guided Adversarial Attacks on Transformer-Based Malware Detectors Using Control Flow Graphs](https://mlsanity.com/paper/2604.03843/) (2026)
- [Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detection](https://mlsanity.com/paper/2609.24280/) (2026)

## Abstract (arXiv)

Control Flow Graphs (CFGs) are critical for analyzing program execution and characterizing malware behavior. With the growing adoption of Graph Neural Networks (GNNs), CFG-based representations have proven highly effective for malware detection. This study proposes a novel framework that dynamically constructs CFGs and embeds node features using a hybrid approach combining rule-based encoding and autoencoder-based embedding. A GNN-based classifier is then constructed to detect malicious behavior from the resulting graph representations. To improve model interpretability, we apply state-of-the-art explainability techniques, including GNNExplainer, PGExplainer, and CaptumExplainer, the latter is utilized three attribution methods: Integrated Gradients, Guided Backpropagation, and Saliency. In addition, we introduce a novel aggregation method, called RankFusion, that integrates the outputs of the top-performing explainers to enhance the explanation quality. We also evaluate explanations using two subgraph extraction strategies, including the proposed Greedy Edge-wise Composition (GEC) method for improved structural coherence. A comprehensive evaluation using accuracy, fidelity, and consistency metrics demonstrates the effectiveness of the proposed framework in terms of accurate identification of malware samples and generating reliable and interpretable explanations.