Publication Date
Spring 2026
Degree Type
Master's Project
Degree Name
Master of Science in Computer Science (MSCS)
Department
Computer Science
First Advisor
Fabio Di Troia
Second Advisor
Navrati Saxena
Third Advisor
William Andreopoulos
Keywords
Malware, EMBER 2018, CapsNet, LightGBM, Large Language Models
Abstract
Malware detection via machine learning has proved to be promising; however, the model’s decisions may not always be easy to understand for humans. The current work examines the possibility of using hierarchical malware detection systems to build a malware detector with good predictive performance and explainability of reasoning behind the decisions made by the model. The approach suggested in the work relies on adapting the AV-Agent solution using the EMBER 2018 dataset by combining three branch models, namely CapsNet, LightGBM-HF, and LightGBM-CFG. These models’ predictions are merged using a weighted ensemble as the core classifier. Above this classifier, a layer of large language models (LLMs) is added to generate explanations of challenging cases, to summarize the disagreements between models, and to provide reasoning similar to an audit. Finally, the obtained ensemble showed an accuracy of about 94.4% and an F1-score close to 0.943 on the EMBER test set consisting of 200,000 samples. Of the tested LLMs, Claude provided the best explanations but was the most expensive, OpenAI balanced well between the two metrics, while Gemini required some technical fixes yet had weaker reasoning compared to other LLMs.
Recommended Citation
Shanigarapu, Pranay, "Explainable Malware Detection: Integrating Hierarchical Machine Learning with Large Language Model Reasoning on the EMBER Dataset" (2026). Master's Projects. 1832.
DOI: https://doi.org/10.31979/etd.g9r8-utb2
https://scholarworks.sjsu.edu/etd_projects/1832
