Deep learning classifiers achieve state-of-the-art performance in various
risk detection applications. They explore rich semantic representations and are
supposed to automatically discover risk behaviors. However, due to the lack of
transparency, the behavioral semantics cannot be conveyed to downstream
security experts to reduce their heavy workload in security analysis. Although
feature attribution (FA) methods can be used to explain deep learning, the
underlying classifier is still blind to what behavior is suspicious, and the
generated explanation cannot adapt to downstream tasks, incurring poor
explanation fidelity and intelligibility. In this paper, we propose FINER, the
first framework for risk detection classifiers to generate high-fidelity and
high-intelligibility explanations. The high-level idea is to gather explanation
efforts from model developer, FA designer, and security experts. To improve
fidelity, we fine-tune the classifier with an explanation-guided multi-task
learning strategy. To improve intelligibility, we engage task knowledge to
adjust and ensemble FA methods. Extensive evaluations show that FINER improves
explanation quality for risk detection. Moreover, we demonstrate that FINER
outperforms a state-of-the-art tool in facilitating malware analysis.

该研究论文提出了 FINER 框架，用于生成高保真度和高可理解性的风险检测分类器解释。该框架通过从模型开发者、特征归因设计者和安全专家中获得解释，通过解释引导的多任务学习策略来提高保真度，并通过任务知识来提高可理解性。针对风险检测，FINER 改善了解释质量，并在恶意软件分析方面超过了最先进的工具。