Search

Malware detection is a constant challenge in cybersecurity due to the rapid development of new attack techniques. Traditional signature-based approaches struggle to keep pace with the sheer volume of malware samples. Machine learning offers a promising solution, but faces issues of generalization to unseen samples and a lack of explanation for the instances identified as malware. However, human-understandable explanations are especially important in security-critical fields, where understanding model decisions is crucial for trust and legal compliance. While deep learning models excel at malware detection, their black-box nature hinders explainability. Conversely, interpretable models often fall short in performance. To bridge this gap in this application domain, we propose the use of Logic Explained Networks (LENs), which are a recently proposed class of interpretable neural networks providing explanations in the form of First-Order Logic (FOL) rules. This paper extends the application of LENs to the complex domain of malware detection, specifically using the large-scale EMBER dataset. In the experimental results we show that LENs achieve robustness that exceeds traditional interpretable methods and that are rivaling black-box models. Moreover, we introduce a tailored version of LENs that is shown to generate logic explanations with higher fidelity with respect to the model's predictions.

Recent observations in emission, extinction, and polarisation have at least partially invalidated most of the astronomical standard grain models for the diffuse ISM. Moreover, lab measurements on interstellar silicate analogues have shown differences with the optical properties used in these standard models. To address these issues, our objective is twofold: (i) to update the optical properties of silicates and (ii) to develop the THEMIS dust model to allow the calculation of polarised extinction and emission. Based on optical constants measured in the lab for amorphous silicates and on observational constraints in mid-IR extinction and X-ray scattering, we defined new optical constants for the THEMIS silicates. Absorption and scattering efficiencies for spheroidal grains were then derived with the discrete dipole approximation. These new optical properties make it possible to explain the dust emission and extinction, both total and polarised. The model is not yet pushed to its limits since it does not require the perfect alignment of all grains to explain the observations and it therefore has the potential to accommodate the highest polarisation levels inferred from extinction measures. Moreover, the dispersion of the optical properties of the different lab silicates naturally explain the variations in both the total and polarised emission and extinction observed in the diffuse ISM. A single, invariant model calibrated on one single set of observations is obsolete for explaining contemporary observations. We are proposing a completely flexible dust model based entirely on lab measurements that has the potential to make major advances in understanding the nature of ISM grains and how they evolve as a function of their environment. Even if challenging, this is also relevant for future missions that will aim to perform precise measurements of the CMB spectral distortions and polarisation., Comment: Accepted for publication by A&A ; abstract modified to match the arxiv standard ; typo corrected on 19/01/2024 in Tab. 3 ; units corrected on 07/02/2024 in Figs. 9 and C.2