G-FLEX: A Graph-Based and Fine-Tuned Transformer Framework with Explainable AI for Fileless Malware Detection

Fileless malware presents a growing cybersecurity challenge due to its stealthy, memory-resident behavior that evades traditional detection methods. In this paper, we propose G-FLEX (Graph-based Fileless maLwarE eXplanation), a novel framework that combines graph representations, fine-tuned transformers, and explainable AI (XAI) to detect and interpret fileless malware threats. Our method begins with the transformation of source code into Abstract Syntax Trees (ASTs) and Control Flow Graphs (CFGs) to structure code behavior and eliminate irrelevant noise. To capture deep semantic and syntactic features, we fine-tune state-of-the-art language models such as BERT, Electra, and CodeBERT, and incorporate Hierarchical Transformers to model multi-level code dependencies. GraphCodeBERT is further employed to generate enriched graph-aware embeddings. For interpretability, we apply XAI techniques, notably SHAP, to identify influential features such as function calls, AST node patterns, and CFG structures that drive the model’s decisions. Experimental results indicate that G-FLEX achieves over 99% accuracy on both standard and obfuscated fileless malware samples, significantly outperforming existing approaches. These results demonstrate the real-world potential of G-FLEX in enhancing fileless malware detection while providing transparency and actionable insights for cybersecurity analysts.