Explainable AI for Malware Detection: Feature Importance Analysis Using SHAP and Machine Learning

Abstract

Malware attacks have increased significantly recently, posing serious threats to computer systems, network infrastructures, and critical digital services. Traditional malware detection techniques mainly rely on signature based approaches, which are often ineffective in detecting newly emerging, polymorphic, and previously unseen malware variants. To address this limitation, machine learning techniques have been widely adopted to enhance malware detection by identifying hidden patterns and structural characteristics in executable files. This paper presents a machine learning-based malware detection framework using features extracted from Windows Portable Executable (PE) files. The dataset, stored in a structured format such as a malware.csv file, is preprocessed and analyzed using several machine learning classifiers, including Support Vector Machine (SVM), Random Forest (RF), Decision Tree (DT), Naïve Bayes (NB), Logistic Regression (LR), and K-Nearest Neighbors (KNN). To improve model transparency and interpretability, Shapley Additive Explanations (SHAP) are employed to analyze the contribution of individual features toward classification decisions. The SHAP-based feature importance approach helps identify the most influential features responsible for malware detection while also reducing model complexity and computational cost. Experimental results demonstrate that integrating SHAP with machine learning classifiers enhances detection accuracy and provides meaningful explanations for model predictions. The proposed approach highlights the effectiveness of explainable machine learning techniques in developing accurate, interpretable, and efficient malware detection systems for modern cybersecurity applications.