{"id":"https://openalex.org/W7163155886","doi":"https://doi.org/10.1109/tnsm.2026.3699408","title":"Reliable Interpretations of Deep Learning-Based Malware Detectors via Deep Q-Networks","display_name":"Reliable Interpretations of Deep Learning-Based Malware Detectors via Deep Q-Networks","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7163155886","doi":"https://doi.org/10.1109/tnsm.2026.3699408"},"language":null,"primary_location":{"id":"doi:10.1109/tnsm.2026.3699408","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2026.3699408","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100554265","display_name":"Huijuan Zhu","orcid":null},"institutions":[{"id":"https://openalex.org/I115592961","display_name":"Jiangsu University","ror":"https://ror.org/03jc41j30","country_code":"CN","type":"education","lineage":["https://openalex.org/I115592961"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Huijuan Zhu","raw_affiliation_strings":["School of Computer Science and Communication Engineering, Jiangsu University, Zhenjiang, China"],"raw_orcid":"https://orcid.org/0000-0003-2751-2607","affiliations":[{"raw_affiliation_string":"School of Computer Science and Communication Engineering, Jiangsu University, Zhenjiang, China","institution_ids":["https://openalex.org/I115592961"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119422488","display_name":"Chenhao Zhen","orcid":null},"institutions":[{"id":"https://openalex.org/I115592961","display_name":"Jiangsu University","ror":"https://ror.org/03jc41j30","country_code":"CN","type":"education","lineage":["https://openalex.org/I115592961"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chenhao Zheng","raw_affiliation_strings":["School of Computer Science and Communication Engineering, Jiangsu University, Zhenjiang, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Communication Engineering, Jiangsu University, Zhenjiang, China","institution_ids":["https://openalex.org/I115592961"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137699894","display_name":"Zhongyuan Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I115592961","display_name":"Jiangsu University","ror":"https://ror.org/03jc41j30","country_code":"CN","type":"education","lineage":["https://openalex.org/I115592961"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhongyuan Liu","raw_affiliation_strings":["School of Computer Science and Communication Engineering, Jiangsu University, Zhenjiang, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Communication Engineering, Jiangsu University, Zhenjiang, China","institution_ids":["https://openalex.org/I115592961"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5137677733","display_name":"Yuan Zhang","orcid":"https://orcid.org/0000-0001-9682-5231"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan Zhang","raw_affiliation_strings":["State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0001-9682-5231","affiliations":[{"raw_affiliation_string":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.69907773,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"23","issue":null,"first_page":"5801","last_page":"5814"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.8176000118255615,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.8176000118255615,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.08980000019073486,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.01940000057220459,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.5569999814033508},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.4846000075340271},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.32440000772476196},{"id":"https://openalex.org/keywords/reliability","display_name":"Reliability (semiconductor)","score":0.3093999922275543},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.29820001125335693}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8285999894142151},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.5569999814033508},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.4846000075340271},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42149999737739563},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.32440000772476196},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32269999384880066},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.3093999922275543},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.305400013923645},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.29820001125335693},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.27649998664855957},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.26809999346733093},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.2551000118255615},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2500999867916107}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnsm.2026.3699408","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2026.3699408","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7034178397","display_name":null,"funder_award_id":"62272204","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Deep":[0,54],"learning":[1],"has":[2],"become":[3],"widely":[4],"used":[5],"in":[6,20,69,111,174,192],"Android":[7],"malware":[8,72,155],"detection,":[9],"but":[10],"its":[11,18],"black-box":[12],"nature":[13],"raises":[14],"trust":[15],"concerns,":[16],"limiting":[17],"use":[19],"critical":[21,64,162],"security":[22],"areas.":[23],"To":[24,74],"address":[25],"this,":[26],"various":[27],"interpretation":[28,58,151],"methods":[29],"have":[30],"been":[31],"proposed.":[32],"Unfortunately,":[33],"these":[34,189],"solutions":[35],"often":[36],"suffer":[37],"from":[38,87],"inconsistent":[39],"results":[40,113],"and":[41],"poor":[42],"adaptability":[43],"to":[44,61,106,123,168],"model":[45,100,105,122],"updates.":[46],"In":[47],"this":[48],"work,":[49],"we":[50],"propose":[51],"XDQNMal,":[52],"a":[53,98],"Q-Networks":[55],"(DQN)-based":[56],"global":[57],"framework":[59,148],"designed":[60],"uncover":[62],"the":[63,76,88,102,120,126,133,145,161,175,178,186,193],"features":[65,85,129,163,190],"that":[66,144,177],"drive":[67],"decisions":[68],"deep":[70,153],"learning-based":[71,154],"detectors.":[73],"enhance":[75],"reliability":[77],"of":[78,91,172],"interpretation,":[79],"XDQNMal":[80,147,166],"captures":[81],"API":[82],"call":[83],"frequency":[84],"derived":[86],"runtime":[89],"behavior":[90],"each":[92],"application":[93],"(App).":[94],"Then,":[95],"it":[96],"unites":[97],"DQN":[99,121],"with":[101],"TabPFN":[103],"detection":[104,112,134,156],"work":[107],"collaboratively,":[108],"using":[109],"variations":[110],"as":[114,130,183],"reward":[115],"signals.":[116],"These":[117],"signals":[118],"guide":[119],"gradually":[124],"identify":[125],"most":[127],"impactful":[128],"interpretations":[131],"for":[132,152],"model\u2019s":[135,194],"decisions.":[136],"Our":[137],"experimental":[138],"evaluation":[139],"on":[140],"real-world":[141],"datasets":[142],"demonstrates":[143],"proposed":[146],"generates":[149],"reliable":[150],"models.":[157],"For":[158],"instance,":[159],"suppressing":[160],"identified":[164],"by":[165],"leads":[167],"an":[169],"average":[170],"decrease":[171],"20.30%":[173],"probability":[176],"malicious":[179],"sample":[180],"is":[181],"predicted":[182],"malicious,":[184],"highlighting":[185],"pivotal":[187],"role":[188],"play":[191],"decision-making.":[195]},"counts_by_year":[],"updated_date":"2026-07-10T05:49:55.623906","created_date":"2026-06-03T00:00:00"}