An Explainable Deep Learning Pipeline for Malware Family Classification: GAF Image Encoding and API-Grounded LLM Interpretation

Abstract

Signature-based malware detection is undermined by obfuscation and packing, motivating dynamic analysis of Application Programming Interface (API) call sequences. Existing image-based classifiers reach high accuracy but rarely explain why a sample belongs to a given family. In this paper, our goal is not to maximize classification accuracy but to demonstrate and characterize an explainable pipeline that both classifies and explains: API call sequences from the WinMET dataset are encoded as order-preserving Gramian Angular Field (GAF) images and classified with a ResNet-50, after which Grad-CAM activations are reverse-mapped to the contributing API calls, whose names, categories, arguments, and return values are passed to a single large language model (LLM) that generates a natural-language rationale. We evaluate classification and explanation jointly on ten malware families (16,771 samples) through three experiments: a GAF-versus-heatmap comparison under identical conditions, a per-family Grad-CAM faithfulness analysis, and a reference-free LLM-as-a-Judge assessment of interpretation quality. Consistent with this explanatory aim, GAF matched the heatmap on overall accuracy (about 0.80) while performing comparably on Macro-F1 (0.63 versus 0.61: higher on the single fixed split, with Welch’s t-test p=0.015, but statistically comparable under five-fold cross-validation); per-family faithfulness varied widely (0.08 to 0.80), and, under two independent LLM judges (GPT-4o and GPT-4.1), supplying argument-level context significantly reduced—rather than improved—the judged quality (best score from a zero-shot prompt without parameters: 13.34 of 15); a small human expert evaluation further indicated that the automated judges rewarded fluent but over-attributed rationales. This work contributes a feasible, fully containerized and reproducible framework for explainable malware family classification.