Learning Explainable Representations of Malware Behavior

We address the problems of identifying malware in network telemetry logs and providing indicators compromise—comprehensible explanations behavioral patterns that identify threat. In our system, an array specialized detectors abstracts network-flow data into comprehensible events a first step. develop neural processes this sequence identifies specific threats, families broad categories malware. then use integrated-gradients method to highlight jointly constitute characteristic pattern compare architectures based on CNNs, LSTMs, transformers, explore efficacy unsupervised pre-training experimentally large-scale data. demonstrate how system detects njRAT other patterns.