Rule Extraction and Interaction-Aware Explainability for AI-Driven Malware Detection

This repository accompanies the paper submission:
"Rule Extraction and Interaction-Aware Explainability for AI-Driven Malware Detection"
(Submitted to RuleML+RR 2025)

---

📋 Overview

This repository implements a unified explainability framework for AI-based malware detection. It supports:

• First-order: Global feature importance using SHAP
• Second-order: Interaction detection using an extended SHAP formalism
• Higher-order: Symbolic rule extraction from model behavior using an extended Anchor approach

The system builds on an MLP model trained on binarized static features from the EMBER dataset, and is further validated on a synthetic XoR dataset to assess rule generalization.

---

🗂️ Repository Contents

• RuleXAI_Malware.zip: Compressed folder containing:
  • Training_and_explain.py
  • extended_anchor.py
  • extended_shap.py
  • ember_dataset.csv
  • XoR_dataset.csv
• README.md: Overview and instructions

---

⚙️ Requirements

Install dependencies using:

pip install pandas numpy scikit-learn matplotlib shap sympy tensorflow joblib anchor-exp tqdm

Tested with:

• Python 3.9+
• TensorFlow 2.9+
• SHAP 0.41+
• scikit-learn 1.2+

---

🚀 Running the Pipeline

To run the full pipeline:

python Training_and_explain.py

This script will:

• Train a multi-layer perceptron (MLP) on EMBER features
• Generate:
  • SHAP summary and beeswarm plots (shap_summary.pdf, beeswarm_plot.pdf) using baseline SHAP
  • Pairwise SHAP interaction plots (pairwise_plot.pdf, query_plot_*.pdf) using the extended SHAP
• Extract symbolic global rules via the extended Anchor algorithm:
  • Saves rules to explanations_output_joblib.csv and filtered_df.csv

---

🧠 Explanation Framework

🔹 First-Order (SHAP)

Generates global feature relevance using SHAP.

🔹 Second-Order (Extended SHAP)

Captures synergistic or antagonistic pairwise feature interactions using a direction-aware SHAP extension.

🔹 Higher-Order (Extended Anchor)

Symbolic rules are extracted across multiple true-positive samples and simplified to form a global disjunctive normal form (DNF) explanation of the model.

---

🧪 Dataset Summary

• EMBER: Static features from Windows binaries (benign and malicious)
• XoR: Synthetic binary logic dataset for validating rule extraction on known non-linear patterns

---

📬 Contact

For feedback or collaboration, please contact:

• Peter Anthony — peter.anthony@fmph.uniba.sk

---

📌 Note: This codebase accompanies a paper currently under submission. Please check back later for citation updates once published.