Pugazh24/X-MalForensics-XGBoost

X-MalForensics: Explainable AI for Malware Detection

This is an XGBoost model trained on the EMBER 2018 dataset to detect malicious Windows Portable Executables (PE files).

Model Description

• Objective: Classify PE files as Benign or Malicious.
• Algorithm: XGBoost Classifier (tree_method="hist")
• Dataset: EMBER 2018 (600,000 training samples)
• Features: 2,381 structural PE features.
• Performance: 91.89% Accuracy, 0.9787 ROC-AUC.

Explainable AI (XAI) Integration

This model is specifically designed to be used alongside SHAP (SHapley Additive exPlanations) to provide local and global forensic blueprints. It maps arbitrary feature indices to human-readable MITRE ATT&CK behaviors, moving away from "black-box" detection.

Usage

This model requires the xgboost and ember libraries.

import xgboost as xgb
model = xgb.XGBClassifier()
model.load_model("baseline_xgboost.json")