X-MalNet: A CNN-Based Malware Detection Model with Visual and Structural Interpretability

The escalating complexity of modern malware continues to undermine the effectiveness of traditional signature-based detection techniques, which are often unable to adapt to rapidly evolving attack patterns. To address these challenges, this study proposes X-MalNet, a lightweight Convolutional Neural Network (CNN) framework designed for static malware classification through image-based representations of binary executables. By converting malware binaries into grayscale images, the model extracts distinctive structural and texture-level features that signify malicious intent, thereby eliminating the dependence on manual feature engineering or dynamic behavioral analysis. Built upon a modified AlexNet architecture, X-MalNet employs transfer learning to enhance generalization and reduce computational cost, enabling efficient training and deployment on limited hardware resources. To promote interpretability and transparency, the framework integrates Gradient-weighted Class Activation Mapping (Grad-CAM) and Deep SHapley Additive exPlanations (DeepSHAP), offering spatial and pixel-level visualizations that reveal how specific image regions influence classification outcomes. These explainability components support security analysts in validating the model’s reasoning, strengthening confidence in AI-assisted malware detection. Comprehensive experiments on the Malimg and Malevis benchmark datasets confirm the superior performance of X-MalNet, achieving classification accuracies of 99.15% and 98.72%, respectively. Further robustness evaluations using Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) adversarial attacks demonstrate the model’s resilience against perturbed inputs. In conclusion, X-MalNet emerges as a scalable, interpretable, and robust malware detection framework that effectively balances accuracy, efficiency, and explainability. Its lightweight design and adversarial stability position it as a promising solution for real-world cybersecurity deployments, advancing the development of trustworthy, automated, and transparent malware classification systems.