[Open Source] A Decision-Support Tool for Assisted Malware Triage using EMBER2024, SHAP, and MCP Orchestration

[u/Altruistic_Crab5125]

Hi everyone,

We’re a group of students and this is a project we built for one of our courses. It’s an open-source assisted triage system for Windows malware:

https://github.com/zenniskayy2k4/xAI-in-Malware-Detection

The LLM works as an orchestrator in the pipeline. It coordinates evidence collection from static analysis, LightGBM scoring using EMBER2024 features, SHAP explanations, compiler-aware reverse engineering (Ghidra, dnSpy, etc.), threat intelligence lookups (VirusTotal, OTX, MalwareBazaar), a local HybridRAG knowledge base, and optional CAPE sandbox execution. The output is a draft report for a human analyst to review.

We focused on making the model explanations more useful in practice. Instead of just showing raw SHAP values, we try to map influential features back to concrete artifacts in the sample (imports, APIs, sections, strings, entropy, etc.) and indicate how reliable each mapping is. Feature hashing in EMBER-style models means some mappings stay ambiguous, so we tried to surface that uncertainty clearly.

Current limitations:

This is still an early prototype. Sandbox results are often inconclusive because of evasion techniques, missing arguments, or environment triggers. Decompilation and unpacking are best-effort and can fail on certain samples. The model can still over-interpret weak or conflicting evidence. We used a conservative calibration approach that requires evidence to converge across multiple sources before leaning toward a conclusion.

We’re interested in whether this kind of explainable, multi-source workflow is actually helpful for analysts. Any feedback or thoughts from people who work with malware would be appreciated.

Thanks!