This paper proposes a novel stacking ensemble framework for graph-based malware detection and explanation. It extracts a Control Flow Graph (CFG) from a PE file and encodes its basic blocks using a two-stage embedding strategy. Using multiple GNN-based learners with different message-passing mechanisms, it captures complementary behavioral features. A meta-learner implemented as an attention-based multilayer perceptron quantifies the contributions of each underlying model and classifies malware. We introduce an ensemble-aware post-explanation technique that fuses edge-level importance scores from GNN explainers using attention weights, generating interpretable and model-independent explanations consistent with the final ensemble decision. Experimental results demonstrate that the proposed framework improves classification performance while providing insightful interpretations of malware behavior.
