This paper proposes a novel framework for malware detection based on control flow graphs (CFGs). We embed CFG node features using a hybrid approach combining rule-based encoding and autoencoder-based embedding, and use a GNN-based classifier to detect malicious behavior. To enhance model interpretability, we apply GNNExplainer, PGExplainer, and CaptumExplainer (using Integrated Gradients, Guided Backpropagation, and Saliency). We also enhance the quality of explanations using a novel aggregation method, RankFusion. We also propose a novel subgraph extraction strategy called Greedy Edge-wise Composition (GEC), and we validate the effectiveness of the proposed framework through comprehensive evaluations using accuracy, fidelity, and consistency metrics.
