  In recent years, there has been a significant surge in malware attacks,
necessitating more advanced preventive measures and remedial strategies. While
several successful AI-based malware classification approaches exist categorized
into static, dynamic, or online analysis, most successful AI models lack easily
interpretable decisions and explanations for their processes. Our paper aims to
delve into explainable malware classification across various execution
environments (such as dynamic and online), thoroughly analyzing their
respective strengths, weaknesses, and commonalities. To evaluate our approach,
we train Feed Forward Neural Networks (FFNN) and Convolutional Neural Networks
(CNN) to classify malware based on features obtained from dynamic and online
analysis environments. The feature attribution for malware classification is
performed by explainability tools, SHAP, LIME and Permutation Importance. We
perform a detailed evaluation of the calculated global and local explanations
from the experiments, discuss limitations and, ultimately, offer
recommendations for achieving a balanced approach.
