UNB Researchers Make AI Malware Detection Explainable with a 'Dual Prototype' Framework

Machine learning is good at spotting malware. Explaining why it flagged a file is another problem entirely — and for security teams deciding what to quarantine, "trust me" is not an answer.

A poster from UNB's Canadian Institute for Cybersecurity tackles exactly that gap. Prototype-Guided Dual Explanations for GNN-Based Malware Detection, by researchers Hossein Shokouhinejad, Roozbeh Razavi-Far, Griffin Higgins, and Ali A. Ghorbani — the institute's founding director and 2026 Order of New Brunswick recipient — will be on the wall at the PST Cybersecurity Summit 2026 in Fredericton on Aug. 20.

The problem: black-box verdicts

Modern malware detectors increasingly lean on Graph Neural Networks (GNNs), which model a program's structure — its call graph, dependencies, and behaviour — as a graph rather than a flat blob of bytes. That structure is powerful, but GNN verdicts are notoriously hard to explain: a security analyst gets a malicious/benign label without a legible reason.

The approach: prototypes with two views

The proposed framework introduces dual prototype-based explanations. The model learns representative prototypes — typical benign and typical malicious behavioural patterns — and each verdict is explained by connecting it to those prototypes.

The "dual" part: explanations are grounded on both sides — what makes this sample look benign, and what makes it look malicious — so an analyst sees the decision anchored in known behaviour rather than abstract features. The researchers say the approach keeps strong detection capability while making the reasoning interpretable and security-focused.

The poster sits on top of a sustained line of work from the same four researchers. Their open-access paper "Enhancing GNN Explanations for Malware Detection with Dual Subgraph Matching", published in Machine Learning and Knowledge Extraction in December 2025, develops the same two-sided explanation idea by matching a sample's subgraphs against reference behaviour — and the group presented a broader GNN malware portfolio at an IEEE data-mining workshop a month earlier.

Why it matters

Explainability is a deployment requirement, not a nice-to-have, for security tooling. Regulated buyers, managed-security providers, and SOC teams need to justify automated decisions. Work that makes AI malware detection legible — without sacrificing detection rate — is exactly the kind of research that flows from the institute's labs into the province's security companies and their customers.

Sources

• Canadian Institute for Cybersecurity: Research Spotlight post — project summary, authors, and approach
• Enhancing GNN Explanations for Malware Detection with Dual Subgraph Matching — Shokouhinejad, Razavi-Far, Higgins and Ghorbani, Machine Learning and Knowledge Extraction, Dec. 2025; open access (CC BY)
• A Research and Development Portfolio of GNN Centric Malware Detection, Explainability, and Dataset Curation — same group, IEEE ICDMW 2025; wider programme context