# Dual Explanations via Subgraph Matching for Malware Detection

arXiv: https://arxiv.org/abs/2504.20904 · HTML: https://mlsanity.com/paper/2504.20904/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 31 references that are in the map.
- First posted on arXiv 29 Apr 2025.

## Builds on (most cited first, 9 of 9)

- [Captum: A unified and generic model interpretability library for PyTorch](https://mlsanity.com/paper/2009.07896/) (2020)
- [Parameterized Explainer for Graph Neural Network](https://mlsanity.com/paper/2011.04573/) (2020)
- [On Explainability of Graph Neural Networks via Subgraph Explorations](https://mlsanity.com/paper/2102.05152/) (2021)
- [Multilevel Graph Matching Networks for Deep Graph Similarity Learning](https://mlsanity.com/paper/2007.04395/) (2020)
- [HAWK: Rapid Android Malware Detection through Heterogeneous Graph Attention Networks](https://mlsanity.com/paper/2108.07548/) (2021)
- [Recent Advances in Malware Detection: Graph Learning and Explainability](https://mlsanity.com/paper/2502.10556/) (2025)
- [GraphMoco:a Graph Momentum Contrast Model that Using Multimodel Structure Information for Large-scale Binary Function Representation Learning](https://mlsanity.com/paper/2305.10826/) (2023)
- [Explainable Malware Detection through Integrated Graph Reduction and Learning Techniques](https://mlsanity.com/paper/2412.03634/) (2024)
- [On the Consistency of GNN Explanations for Malware Detection](https://mlsanity.com/paper/2504.16316/) (2025)

## Built on by (most cited first, 2 of 2)

- [Explainable Attention-Guided Stacked Graph Neural Networks for Malware Detection](https://mlsanity.com/paper/2508.09801/) (2025)
- [Routing-Aware Explanations for Mixture of Experts Graph Models in Malware Detection](https://mlsanity.com/paper/2602.19025/) (2026)

## Abstract (arXiv)

Interpretable malware detection is crucial for understanding harmful behaviors and building trust in automated security systems. Traditional explainable methods for Graph Neural Networks (GNNs) often highlight important regions within a graph but fail to associate them with known benign or malicious behavioral patterns. This limitation reduces their utility in security contexts, where alignment with verified prototypes is essential. In this work, we introduce a novel dual prototype-driven explainable framework that interprets GNN-based malware detection decisions. This dual explainable framework integrates a base explainer (a state-of-the-art explainer) with a novel second-level explainer which is designed by subgraph matching technique, called SubMatch explainer. The proposed explainer assigns interpretable scores to nodes based on their association with matched subgraphs, offering a fine-grained distinction between benign and malicious regions. This prototype-guided scoring mechanism enables more interpretable, behavior-aligned explanations. Experimental results demonstrate that our method preserves high detection performance while significantly improving interpretability in malware analysis.