Semantic Feature Extraction from PE Headers for Malware Classification
TL;DR
A 60-feature taxonomy is presented that matches EMBER’s F1 in a directly compared head-to-head while using 39 × fewer features, a benign-source hold-out rules out a single-source artefact for the dominant feature, and Wilson-95% PPV bounds under deployment priors quantify what practitioners face at sub-1% malware prevalence.
Abstract
: Portable Executable (PE) malware classifiers are routinely benchmarked on malware-only data or against small homogeneous benign corpora. Recent surveys (Ucci et al., 2019; Aboaoja et al., 2022) note that most existing PE-feature studies select attributes by availability or precedent rather than by security rationale, and large benchmarks such as EMBER (Anderson and Roth, 2018) group 2 , 381 features only by extraction source while Ahmadi et al. (Ahmadi et al., 2016) similarly use > 1 , 800 features without semantic categorisation. We argue this practice misrepresents which signals a deployed detector actually relies on: the relative importance of the same 60 PE-header features changes substantially when benign samples are added to the evaluation, and shifts further as the benign corpus is diversified beyond a single source. To support this claim we organise 60 PE-header attributes into seven security-rationale categories (Structure Integrity, Execution Context, Memory Layout, Security Posture, Code Characteristics, Resource/Import, Anomaly Indicators) and evaluate on 1,263 MalwareBazaar samples plus 1,132 benign PE files (170 SysInternals + 962 DikeDataset (Iosif, 2021)). The 60-feature taxonomy matches EMBER’s F1 in a directly compared head-to-head while using 39 × fewer features, a benign-source hold-out rules out a single-source artefact for the dominant feature, and Wilson-95% PPV bounds under deployment priors quantify what practitioners face at sub-1% malware prevalence.