An Interpretable Ensemble Framework for Malware Classification Based on API and DLL Feature Importance

Most software frequently relies on native application programming interfaces (APIs) and dynamic link libraries (DLLs) that are inherently provided by operating systems. While these components are typically legitimate, they can be misused by malicious actors to construct malware. Detecting such threats often involves identifying specific combinations of API functions and DLLs indicative of harmful behavior. Therefore, in this study, we propose a machine learning-based framework to learn the patterns of API and DLL combinations that contribute to malicious behavior while simultaneously filtering out irrelevant or unrelated features that introduce noise and increase computational complexity. To achieve this, the proposed model employs the XGBoost algorithm in the initial phase for feature selection, leveraging its robustness in handling high-dimensional data and identifying the most influential features. Subsequently, a comparative analysis is conducted using a range of Machine Learning (ML) and Deep Learning (DL) models, evaluated on both the noise-reduced and original noisy datasets. This dual-stage approach enables a more accurate interpretation of each model’s behavior and ensures fair performance comparison by isolating the influence of unrelated features. Finally, the ensemble framework enhances model explainability, improves detection transparency, and facilitates better-informed decisions tailored to the dataset’s characteristics.