## Appendix A  
In this appendix, we report the results of the study's analysis of the Shapley values computed for the decisions yielded with the pre-trained LGBM model for the adversarial malware files generated with the attack methods Extend, Full DOS, Shift and FGSM padding + slack. We consider the adversarial Windows PE malware files that fooled the LGBM model. We recall that the analysis of the Shapley values produced for GAMMA is illustrated in Section 5.4.  
Figures A1-A4 show the distribution of the average Shapley values computed with respect to the \"malware\" class for the top 20 engineered features of the input feature space of LGBM. In particular, the left-side charts (Figures A1a-A4a) show the Shapley values computed to explain the decisions concerning the original Windows PE malware, while the right-side charts (Figures A1b-A4b) show the Shapley values computed to explain the decisions concerning its adversarial malware counterparts.  
Notably, the plots do not show any change in the top 20 features ranked according to the Shapley values for Full DOS, which are shown in Figure A2. This means that LGBM works quite similarly to decide about both Windows PE malware files and their adversarial counterparts produced through Full DOS. This is unsurprising since no adversarial sample produced via Full DOS evaded LGBM. Even 10 Windows PE malware files that were originally misclassified according to LGBM were correctly detected as malware when processed as they were modified via Full DOS (see Table 3). On the other hand, only a few changes appeared in the top 20 features ranked according to the Shapley values for FGSM padding + slack, which are shown in Figure A4. This is the other attack method of this evaluation study that generated adversarial PE malware capable of evading MalConv but not LGBM (see Table 3). On the contrary, numerous changes appeared in the top 20 Shapley-based feature rankings of Extend, shown in Figure A1, and Shift, shown in Figure A3. Both methods, similar to GAMMA, were able to generate some realistic adversarial malware capable of evading LGBM in addition to MalConv (see Table 3). The higher number of changes is seen in the explanation of decisions produced for adversarial malware files produced using Extend, which was the runner-up for GAMMA as the most effective attack method in this study. Hence, this additional exploratory analysis, which was performed to explain how the attack methods Extend, Full DOS, Shift and FGSM padding+slack change the effect of features on decisions yielded via the LGBM model, supports the conclusion drawn in Section 5.4: there is a relationship between the effectiveness of the transferability of a Windows PE attack from MalConv to LGBM and the ability of this attack to introduce some relevant changes in decisions produced via LGBM with transferred adversarial samples.  
Figure 17: Global Shapley values measured for the top 20 input features (axis \(Y\)) of the LGBM input space and plotted with respect to the feature value (axis \(X\)) for the original 7951 PE malware files (**a**) and the adversarial counterparts (**b**) produced using Extend. Changes in the Shapley value-based feature ranking are marked in (**b**).