AI-Powered Behavior-Based Malware Detection Using Advanced Temporal and Process-State Features: A Robust Explainable Framework.

Malware detection remains a critical challenge in modern cybersecurity due to the rapidevolution of attack techniques and the proliferation of adversarial threats. This study introducesa robust, explainable framework for malware detection that leverages advanced temporal andprocess-state features. Using VirusTotal, a large dataset of practical metrics, including system,memory, and process metrics, was created. Gated Recurrent Units (GRU) and Long Short-TermMemory (LSTM) architectures were implemented and frequently tested to model this sequentialbehavioral data. GRU outperformed the others regarding robustness and performance, with99.92% accuracy on original data and 92.61% on adversarial data after retraining withadversarial examples. It also highlights the importance of interpretability by incorporating SHAP(Shapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations)to provide global and local feature importances.