As malware continues to become increasingly sophisticated, threatening, and evasive, malware detection systems must keep pace and become equally intelligent, powerful, and transparent. In this paper, we propose Assembly Flow Graph (AFG) to comprehensively represent the assembly flow of a binary executable as graph data. Importantly, AFG can be used to extract granular explanations needed to increase transparency for malware detection using Graph Neural Networks (GNNs). However, since AFGs may be large in practice, we also propose a Meta-Coarsening approach to improve computational tractability via graph reduction. To evaluate our proposed approach we consider several novel and existing metrics to quantify the granularity and quality of explanations. Lastly, we also consider several hyperparameters in our proposed Meta-Coarsening approach that can be used to control the final explanation size. We evaluate our proposed approach using the CIC-DGG-2025 dataset. Our results indicate that our proposed AFG and Meta-Coarsening approach can provide both increased explainability and inference performance at certain coarsening levels. However, most importantly, to the best of our knowledge, we are the first to consider granular explainability in malware detection using GNNs.

翻译：随着恶意软件日益复杂化、威胁化和规避化，恶意软件检测系统必须同步发展，具备同等的智能性、强大性和透明度。本文提出汇编流图（AFG），以图数据形式全面表征二进制可执行文件的汇编流程。重要的是，AFG可用于提取细粒度解释，从而提升基于图神经网络（GNNs）的恶意软件检测的透明度。然而，由于AFG在实际应用中可能规模较大，本文同时提出元粗化方法，通过图约简提升计算可处理性。为评估所提方法，我们采用若干新颖及现有指标来量化解释的细粒度性与质量。最后，我们还探讨了所提元粗化方法中可用于控制最终解释规模的若干超参数。我们在CIC-DGG-2025数据集上对所提方法进行评估。结果表明，所提出的AFG与元粗化方法在特定粗化层级下能同时提升可解释性与推理性能。但最重要的是，据我们所知，本研究首次在基于GNNs的恶意软件检测中实现了细粒度可解释性。