Explainable Machine Learning for Malware Detection: A SHAP-Based LightGBM Framework

In contemporary malware detection, machine learning has proved an essential component; many models are not transparent, making them less trustworthy and rarely suitable for security use. In this paper, we propose a machine-learning-based malware classification framework trained on static features extracted from the EMBER database of Windows PE files using the LightGBM algorithm. To improve interpretability, we add SHAP (Shapley Additive exPlanations), which allows the analyst to see which features have the most significant influence on a given prediction. The results of the experiments show that our framework achieves 91.16% accuracy, 94.22% recall, and an ROC-AUC of 0.9744, compared with baseline traditional machine learning methods. Qualitative analyses demonstrate that SHAP explanations are effective at highlighting the essential binary features relevant to malware detection, thereby enhancing model comprehensibility and enabling quicker, more informed incident response. We also mention some of the limitations, e.g., the resource required for explainability on large datasets, and what we envisage working on in the future, e.g., utilizing the frameworks with threat intelligence and running on demand.