The black-box nature of complex Neural Network (NN)-based models has hindered
their widespread adoption in security domains due to the lack of logical
explanations and actionable follow-ups for their predictions. To enhance the
transparency and accountability of Graph Neural Network (GNN) security models
used in system provenance analysis, we propose PROVEXPLAINER, a framework for
projecting abstract GNN decision boundaries onto interpretable feature spaces.
We first replicate the decision-making process of GNNbased security models
using simpler and explainable models such as Decision Trees (DTs). To maximize
the accuracy and fidelity of the surrogate models, we propose novel graph
structural features founded on classical graph theory and enhanced by extensive
data study with security domain knowledge. Our graph structural features are
closely tied to problem-space actions in the system provenance domain, which
allows the detection results to be explained in descriptive, human language.
PROVEXPLAINER allowed simple DT models to achieve 95% fidelity to the GNN on
program classification tasks with general graph structural features, and 99%
fidelity on malware detection tasks with a task-specific feature package
tailored for direct interpretation. The explanations for malware classification
are demonstrated with case studies of five real-world malware samples across
three malware families.

PROVEXPLAINER 提出了一种通过将 GNN 决策边界投影到可解释的特征空间来提高 GNN 安全模型透明度和可解释性的框架，使用决策树等可解释性模型复制 GNN 安全模型的决策过程，提高辅助模型的准确性和可信度，实验结果表明，该模型在程序分类任务中达到了 95% 离线度并在特定任务的恶意软件检测任务中达到了 99% 的准确率。