Explainable AI for malware analysis: a systematic review of benchmark datasets, traffic-oriented detection, and interpretability methods.
5 affiliations
- 1Department of Computer Science, Wenzhou Kean University, Wenzhou, China.
- 2Department of Accounting, Wenzhou Kean University, Wenzhou, China.
- 3Department of Computer Science, Al-Imam Mohamed Ibn Saud Islamic University, Riyadh, Saudi Arabia.
- 4Cybersecurity Center, Prince Mohammad Bin Fahd University, Dhahran, Saudi Arabia.
- 5Department of Electrical Engineering Computer Science, Embry-Riddle Aeronautical University, Daytona Beach, FL, United States.
Abstract
In recent years, malicious software (malware) has remained a persistent and evolving threat, affecting both personal and organizational devices across diverse computing environments. This article presents a systematic review of recent progress in malware analysis over the past 5 years, with particular emphasis on benchmark datasets, traffic-oriented detection settings, deep learning methods, and explainable artificial intelligence (XAI) approaches. Representative benchmark resources discussed in the reviewed literature include CIC IoMT 2024, CIC-MalMem-2022, and CICMalDroid 2020, which reflect different malware-analysis contexts such as IoMT/network traffic, memory-based Windows malware behavior, and Android malware analysis. The review examines how prior studies characterize malicious behaviors, evaluate detection paradigms, and employ interpretability techniques such as Local Interpretable Model-Agnostic Explanations (LIME) and Shapley Additive Explanations (SHAP) to improve model transparency and analyst understanding. In addition to summarizing the practical strengths of these approaches, the article discusses current limitations related to interpretability overhead, dataset dependence, scalability, and deployment constraints. The review concludes by identifying major research gaps and outlining future directions for building more scalable, explainable, and trustworthy malware-analysis systems.
Related
- An Explainable Multi-Criteria Decision-Making Framework for Evaluating Malware Detection Models Across Heterogeneous Datasets
- Benchmark Readiness of Open-access Musculoskeletal Radiograph Datasets for Foundation Model Segmentation: A Systematic Audit
- Acoustic Emission Metrology for Real-Time TIG Welding Monitoring: Spectral Characterization and Interpretability via Explainable AI
- Training strategy over architecture: A systematic ablation study for Spartina detection from aerial imagery with small geospatial datasets
- Measuring Structure in Graph Benchmark Datasets Using Graph Invariants
BibTeX
@article{yu2026explainable,
title = {{Explainable AI for malware analysis: a systematic review of benchmark datasets, traffic-oriented detection, and interpretability methods.}},
author = {Bowen Yu and Wanting Zhang and Yishen Liu and Awais Ahmad and Waeal J Obidallah and Yousef Ahmed Alduraywish and Farhan Ullah and Kenji Yoshigoe and Yue Zhao},
journal = {PeerJ. Computer science},
year = {2026},
month = may,
doi = {10.7717/peerj-cs.3902},
url = {https://europepmc.org/article/MED/42953517},
note = {CC BY},
}
RIS
TY - JOUR
TI - Explainable AI for malware analysis: a systematic review of benchmark datasets, traffic-oriented detection, and interpretability methods.
AU - Bowen Yu
AU - Wanting Zhang
AU - Yishen Liu
AU - Awais Ahmad
AU - Waeal J Obidallah
AU - Yousef Ahmed Alduraywish
AU - Farhan Ullah
AU - Kenji Yoshigoe
AU - Yue Zhao
PY - 2026
DA - 2026/05/26
JO - PeerJ. Computer science
DO - 10.7717/peerj-cs.3902
UR - https://europepmc.org/article/MED/42953517
AB - In recent years, malicious software (malware) has remained a persistent and evolving threat, affecting both personal and organizational devices across diverse computing environments. This article presents a systematic review of recent progress in malware analysis over the past 5 years, with particular emphasis on benchmark datasets, traffic-oriented detection settings, deep learning methods, and explainable artificial intelligence (XAI) approaches. Representative benchmark resources discussed in the reviewed literature include CIC IoMT 2024, CIC-MalMem-2022, and CICMalDroid 2020, which reflect different malware-analysis contexts such as IoMT/network traffic, memory-based Windows malware behavior, and Android malware analysis. The review examines how prior studies characterize malicious behaviors, evaluate detection paradigms, and employ interpretability techniques such as Local Interpretable Model-Agnostic Explanations (LIME) and Shapley Additive Explanations (SHAP) to improve model transparency and analyst understanding. In addition to summarizing the practical strengths of these approaches, the article discusses current limitations related to interpretability overhead, dataset dependence, scalability, and deployment constraints. The review concludes by identifying major research gaps and outlining future directions for building more scalable, explainable, and trustworthy malware-analysis systems.
SN - 2167-9843
SN - 2376-5992
ER -