Explainable AI (XAI) & SHAP Contribution Inspector
PILLAR 5: WHITE-BOX EXPLAINABILITYTransparent feature attribution (SHAP & LIME), counterfactual simulation, and plain-English natural language reasoning for SOC analysts.
Inspect Sample:
Base Value E[f(x)]
12.0% (Benign Baseline)
Active Feature Push
+87.9% Malicious
Final Model Verdict f(x)
99.9% MALICIOUS
SHapley Additive exPlanations (SHAP) Waterfall Decomposition
Click toggle to simulate counterfactual: "What if this artifact were stripped or neutralized?"
Red = Pushes Malicious • Green = Pushes Benign
RWX Memory Allocation (PAGE_EXECUTE_READWRITE)
Memory • 0x00400000 (RWX)
+34%
Allocates executable memory for decrypted payload staging.
Removing RWX allocation drops malicious probability by 34%.
vssadmin.exe Delete Shadows Invocation
Process • cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
+28%
Destructive recovery inhibition typical of high-impact ransomware.
Neutralizing shadow copy deletion removes ransomware signature push.
Killswitch HTTP GET to Sinkhole Domain
Network • http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
+18%
Probe to unresolvable domain to trigger conditional payload detonation.
Sinkholing domain triggers execution halt in sandbox.
High Section Entropy in .rsrc Section
PE Static • Entropy: 7.99 / 8.00
+14%
Indicates embedded password-protected encrypted ZIP payload archive.
Unpacked plain PE decreases static entropy weight.
Service Creation 'mssecsvc2.0'
Process • CreateServiceA('mssecsvc2.0')
+9%
Windows service persistence under SYSTEM privileges.
Absence of persistence drops privilege escalation score.
Valid CRT Entry Point & Standard Imports
PE Static • WinMain Entry (KERNEL32/ADVAPI32)
-5%
Presence of standard MSVC runtime CRT boilerplate lowers suspicion slightly.
Standard entrypoint reduces overall anomaly score by 5%.