FINER: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysis

Fuente: arXiv
Saved in:
Bibliographic Details
Main Authors: He, Yiling, Lou, Jian, Qin, Zhan, Ren, Kui
Format: Preprint
Published: 2023
Subjects:
Online Access:
Tags: Add Tag
No Tags, Be the first to tag this record!
_version_ 1866916736139264000
author He, Yiling
Lou, Jian
Qin, Zhan
Ren, Kui
author_facet He, Yiling
Lou, Jian
Qin, Zhan
Ren, Kui
contents Deep learning classifiers achieve state-of-the-art performance in various risk detection applications. They explore rich semantic representations and are supposed to automatically discover risk behaviors. However, due to the lack of transparency, the behavioral semantics cannot be conveyed to downstream security experts to reduce their heavy workload in security analysis. Although feature attribution (FA) methods can be used to explain deep learning, the underlying classifier is still blind to what behavior is suspicious, and the generated explanation cannot adapt to downstream tasks, incurring poor explanation fidelity and intelligibility. In this paper, we propose FINER, the first framework for risk detection classifiers to generate high-fidelity and high-intelligibility explanations. The high-level idea is to gather explanation efforts from model developer, FA designer, and security experts. To improve fidelity, we fine-tune the classifier with an explanation-guided multi-task learning strategy. To improve intelligibility, we engage task knowledge to adjust and ensemble FA methods. Extensive evaluations show that FINER improves explanation quality for risk detection. Moreover, we demonstrate that FINER outperforms a state-of-the-art tool in facilitating malware analysis.
format Preprint
id arxiv_https___arxiv_org_abs_2308_05362
institution arXiv
publishDate 2023
record_format arxiv
spellingShingle FINER: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysis
He, Yiling
Lou, Jian
Qin, Zhan
Ren, Kui
Cryptography and Security
Machine Learning
Software Engineering
Deep learning classifiers achieve state-of-the-art performance in various risk detection applications. They explore rich semantic representations and are supposed to automatically discover risk behaviors. However, due to the lack of transparency, the behavioral semantics cannot be conveyed to downstream security experts to reduce their heavy workload in security analysis. Although feature attribution (FA) methods can be used to explain deep learning, the underlying classifier is still blind to what behavior is suspicious, and the generated explanation cannot adapt to downstream tasks, incurring poor explanation fidelity and intelligibility. In this paper, we propose FINER, the first framework for risk detection classifiers to generate high-fidelity and high-intelligibility explanations. The high-level idea is to gather explanation efforts from model developer, FA designer, and security experts. To improve fidelity, we fine-tune the classifier with an explanation-guided multi-task learning strategy. To improve intelligibility, we engage task knowledge to adjust and ensemble FA methods. Extensive evaluations show that FINER improves explanation quality for risk detection. Moreover, we demonstrate that FINER outperforms a state-of-the-art tool in facilitating malware analysis.
title FINER: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysis
topic Cryptography and Security
Machine Learning
Software Engineering
url https://arxiv.org/abs/2308.05362