Explainable AI for Predicting Malware Threat Levels: A SHAP-Enhanced Random Forest Approach

Abstract

This project presents an explainable AI (XAI) approach for predicting malware threat levels using a SHAP-enhanced Random Forest model. As malware detection becomes increasingly vital in cybersecurity, the need for transparent and interpretable models grows, especially in high-stakes environments. We address this by integrating SHAP (SHapley Additive exPlanations), a widely recognized explainability technique, with Random Forests—a robust ensemble learning method known for its strong predictive performance in classification tasks. The approach involves training the random forest model on a comprehensive dataset of malware features, where SHAP values are then used to provide detailed, human-understandable explanations for the model's predictions. These explanations identify the most significant features influencing the threat level assessments and offer insights into how different malware characteristics affect model decision-making. The model is evaluated using a benchmark malware dataset, achieving high prediction accuracy while maintaining interpretability. Comparative analysis against traditional black-box models, such as deep learning-based approaches, highlights the effectiveness of our method in balancing predictive performance and explainability. This transparency improves trust in AI-driven security systems, enabling security analysts to better interpret and act on predictions. Through experiments, we demonstrate that the SHAP-enhanced Random Forest approach maintains high predictive accuracy while significantly improving interpretability compared to traditional black-box models. The results show its potential for practical deployment in real-world cybersecurity applications, where both high accuracy and explainability are crucial for timely and informed decision-making in threat management.