## 5 Results
### Performance Analysis of Adversarial Training with LGBM and Realistic Windows PE Attack Methods
Figure 6 shows the distribution of the top 20 Shapely values averaged on the decisions yielded via \(LGBM^{O}\) and \(LGBM^{AT}\) with the selected samples. The plots show that the use of adversarial training caused several changes in the top 20 Shapley-based feature ranking of \(LGBM^{O}\) and \(LGBM^{AT}\). The changes observed in the effect of features on decisions explain how adversarial training modified the decision-making process of LGBM to allow the decision model to recognise some of the adversarial PE malware produced with GAMMA and originally misclassified with \(LGBM^{O}\). For example, we note that both high values of \"section_689\" and high values of \"import_1252\" gained relevance from \(LGBM^{O}\) to \(LGBM^{AT}\), in order to recognise the malicious behaviour of the selected adversarial PE malware. Instead, we note a change in the relationship between the Shapley value distribution and the feature value distribution of \"byte_509\". In fact, the higher, positive Shapley values of \"byte_509\" that were measured in correspondence with high values of \"byte_509\" for \(LGBM^{O}\) decisions were measured in correspondence with the low values of \"byte_509\" for \(LGBM^{AT}\) decisions. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \multicolumn{2}{c}{\(LGBM^{O}\)} & \multicolumn{2}{c}{\(LGBM^{AT}\)} \\ \cline{2-5}
**Attack Method** & \(tm\) & \(fg\) & \(tm\) & \(fg\) \\ \hline Extend & 7916 & 35 & 7936 & 15 \\ \hline Full DOS & 6091 & 24 & 6093 & 22 \\ \hline Shift & 3406 & 17 & 3404 & 19 \\ \hline FGSM & 4363 & 21 & 4363 & 21 \\ \hline GAMMA & 6782 & 75 & 6855 & 2 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The number of “true malware” decisions (\(tm\)) and the number of “false goodware” decisions (\(fg\)) yielded via \(LGBM^{O}\) and \(LGBM^{AT}\) for the adversarial Windows PE malware files produced with the Extend, Full DOS, Shift, FGSM padding+slack and GAMMA attack methods and used in the evaluation stage of the \(O+A\) settubg considered in Table 5.  
To complete the analysis of explanations reported in Figure 6, we selected a single Windows PE malware file from the 72 PE malware files explained in Figure 6. Figure 7 shows the top 20 local Shapley values of the input features that have a higher effect on the decisions yielded for the selected sample using \(LGBM^{O}\) and \(LGBM^{AT}\), respectively. This figure also shows values measured for the study sample with the top-ranked input features, as well as the range of values that each top-ranked feature assumes in the set of selected Windows PE malware files explained in Figure 6. The local explanation values produced for the two decisions yielded via both \(LGBM^{O}\) and \(LGBM^{AT}\) for this sample confirm that the correct classification achieved with \(LGBM^{AT}\) can be partially explained by the fact that feature section_689 (which assumes a value equal to 13, which is in the middle part of the feature range [3, 40]), string_567 (which assumes the value equal to 0.009, which is in the lower part of the feature range [0.0056486, 0.0421279), string_513 (which assumes the value 1340, which is in the lower part of the feature range [52, 18,190]) and directories_2358 (which assumes the feature value 0, which is in the lower part of the feature range [0, 48]) gain importance in explaining the model's decision when the correct decision is yielded via the decision model \(LGBM^{AT}\), which was trained using adversarial training. Figure 6: Global Shapley values measured for the top 20 input features (axis \(Y\)) of \(LGBM^{O}\) (**a**) and \(LGBM^{AT}\) using GAMMA (**b**). The global Shapley values are plotted with respect to the feature value (axis \(X\)) for the 72 PE adversarial malware generated with GAMMA, which were wrongly classified in the “goodware” class according to \(LGBM^{O}\) and correctly classified in the “malware” class according to \(LGBM^{AT}\). Changes in the top ranking of the importance of input features for the model’s decisions are marked in (**b**).