Neural Network Malware Classification with Human-Readable Explanations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware classification systems, particularly those using neural networks, face challenges in providing human-readable explanations for their classifications, leading to a lack of transparency and confidence in their accuracy, as the complex interactions and factors contributing to the outputs are difficult for humans to understand.
Innovation Solution
A data-driven automated malware classification system that uses a hierarchical multi-instance-learning neural network trained on input data sets with known classifications, generating human-readable explanations by identifying the most responsible input data subsets contributing to the classification, and providing explanations in logical rules or statistical contributions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a neural network is used for malware classification, then classification accuracy is improved, but transparency and understandability of the classification process deteriorates
Solution Approach 1:
The patent introduces an explanation generation module as an intermediary between the neural network classifier and the user. This module translates the complex internal decisions of the neural network into human-readable explanations by identifying and presenting the most responsible input features and their contributions to the classification decision, thereby maintaining classification accuracy while improving transparency
Solution Approach 2:
The patent uses visual metaphors where different features are highlighted with different colors or intensities to indicate their level of responsibility for the classification. The most responsible features are emphasized (analogous to color changes) to make the classification rationale visually apparent and understandable to users without sacrificing the underlying neural network accuracy
2Loss of information
If detailed analysis of all input features is performed to provide explanations, then transparency is improved, but processing time and computational resources increase
Solution Approach 1:
The patent extracts only the most responsible input features that contribute significantly to the classification decision, rather than analyzing all input features in detail. By identifying and isolating the key contributing features, the system provides transparent explanations while avoiding the computational overhead of analyzing every single input feature
Solution Approach 2:
The patent applies partial action by providing explanations based on a subset of the most influential features rather than performing complete analysis of all features. This partial analysis approach achieves sufficient transparency for user understanding while significantly reducing the processing time and computational resources required
Data Source
AI summary
A malware classification is generated for an input data set with a human-readable explanation of the classification. An input data set having a hierarchical structure is received in a neural network that has an architecture based on a schema determined from a plurality of second input data sets and that is trained to classify received input data sets into one or more of a plurality of classes. An explanation is provided with the output of the neural network, the explanation comprising a subset of at least one input data set that caused the at least one input data set to be classified into a certain class using the schema of the generated neural network. The explanation may further be derived from the statistical contribution of one or more features of the input data set that caused the at least one input data set to be classified into a certain class.