MAL-XGNet: A Lightweight and Explainable Transformer-GNN Hybrid Model for Real-time Detection of Obfuscated Malware in Memory Dumps

The digital transformation boom has made memory dump analysis a central tool in today’s cybersecurity. New breakthroughs in transformer models, graph neural networks (GNNs), and explainable AI have opened up new frontiers for identifying sophisticated malware patterns with improved accuracy, scalability, and transparency. Conventional detection strategies are at a loss against obfuscation mechanisms like polymorphism, encryption, and packing, while deep learning models tend to be computationally costly and black-boxy. We introduce MAL-XGNet, an interpretable and efficient Transformer–GNN ensemble for real-time memory dump-based detection of obfuscated malware. The transformer block effectively extracts sequential memory features, with GNN extracting inter-process and structural relationships for better contextual awareness. An attention-based interpretability module is integrated for transparency and analyst trust. Experimental results demonstrate that MAL-XGNet(Malware eXplainable Graph Network) obtains 99.45% accuracy, 99% recall, and 99% F1-score, with remarkable inference speed up relative to ensemble-based baselines. The obtained results make MAL-XGNet a very effective, explainable, and real-time malware detection solution for contemporary malware detection problems.