arXiv:2606.27109v1 [cs.CR] 25 Jun 2026
PRISM: PE Relational Inter-Section Matrix A 2D Section-Aware Dataset for Static PE Malware Detection José M. Sacristán∗
Ana I. González-Tablas
Universidad Carlos III de Madrid (UC3M) [email protected]
Universidad Carlos III de Madrid (UC3M) [email protected]
Abstract—We introduce PRISM (PE Relational InterSection Matrix), an open dataset and feature representation for static Windows PE malware detection. Existing benchmarks such as EMBER, BODMAS, and SOREL20M represent each PE file as a flat one-dimensional feature vector, discarding the ordering of sections and the relational context between them. PRISM instead encodes every binary as a two-dimensional matrix whose rows are individual PE sections in file order, with a global summary row that preserves compatibility with EMBER-style models. We build the corpus from four malware sources (BODMAS, MalwareBazaar, VirusShare, and CAPE) together with SOREL-20M benign software, yielding 83,633 deduplicated matrices and a family-filtered analysis corpus of 49,204 samples across 684 malware families. A formal separability analysis (Fisher Discriminant Ratio, mutual information, and inter-section information gain) shows that the per-section positional structure carries discriminative information that flat representations cannot capture. Under a strictly controlled, sample-matched comparison, a gradient-boosted classifier on the compact PRISM representation recovers nearly all of the binary-detection performance of the same classifier on the much larger EMBER vector, at roughly one-sixth the dimensionality; EMBER retains only a small, consistent advantage confined to the extreme low-false-positive regime, the two being operationally indistinguishable at the decision threshold. We are explicit that this binary task is saturated, so the structural content PRISM preserves is reserved for tasks with greater metric headroom, such as family classification and architectures that exploit the 2D structure directly. The dataset, extraction library, trained models, and full analysis pipeline are released under CC BY NC-SA and MIT licences. Index Terms—malware detection, PE files, sectionaware features, dataset, EMBER, BODMAS, SOREL20M, LightGBM, mutual information, inter-section context, 2D representation.
I. Introduction The detection of malicious Windows Portable Executable (PE) files through static machine learning has become one of the most active and practically consequential problems in applied cybersecurity. Every day, commercial antivirus engines and endpoint detection platforms must classify millions of PE files — executables, DLLs, and system
drivers — against an adversarial backdrop of constantly evolving malware families. The economic and operational stakes are substantial: a false negative in a corporate environment may allow a ransomware payload to encrypt thousands of files before behavioural detection triggers; a false positive in a high-throughput environment may block legitimate software updates and erode user trust. Since the release of the EMBER dataset in 2018, the standard representation used by virtually every public benchmark has been a flat 1D feature vector of 2,381 dimensions, obtained by concatenating eight heterogeneous feature groups — including byte histograms, string features, header fields, section statistics, and import/export information — extracted using the LIEF library [1]. This representation was a significant contribution to the field: it standardised feature extraction, enabled reproducible comparisons across research groups, and provided a large enough corpus to train competitive gradient-boosted models. The EMBER baseline LightGBM model achieved AUCROC 0.99338 and TPR@FPR=0.1% of 0.8027 on the EMBER2018 benchmark. EMBER2018 is the harder of the two releases, deliberately constructed so that its train/test split is more difficult for machine-learning classifiers than the earlier EMBER2017 set; these figures have accordingly been accepted by much subsequent work as a representative operating point for static 1D approaches. However, the EMBER representation discards two structural pieces of information that are present in every PE binary and are well understood by malware analysts: (1) the ordering of sections within the file, and (2) the relational context between consecutive or co-occurring sections. A packed executable, for instance, typically presents a highentropy stub section at position 0, followed by one or more compressed or encrypted payload sections whose size ratios and permission flags differ systematically from those of legitimate binaries. When this structural pattern is aggregated into a single global vector, the positional signal is irreversibly lost. A classifier operating on the EMBER vector cannot distinguish a packer stub at position 0 from the same byte statistics occurring at position 5. This observation is not merely theoretical. Our empirical analysis shows that the MEM_DISCARDABLE memory
permission flag at section position 5 (MEM_DISC@SEC5, using the feature–position notation defined in Section III) achieves a Fisher Discriminant Ratio (FDR) of 1.287 — where FDR measures inter-class separability as the ratio of between-class variance to within-class variance, formally defined in Section V-A — the single most discriminative (section, feature) cell in our entire feature space. The maximum FDR attained by any single dimension of the PRISM global summary row is 0.858 (log_exports), so the per-section positional representation attains a 1.50× higher peak FDR than any file-level descriptor on the same corpus. More broadly, 12,854 inter-section feature pairs across the (section × feature) lattice carry non-trivial additional mutual information about the malware label (∆I > 0.01 bits) beyond either component feature alone, with the top pair — (raw_size@SEC2, name5@SEC3) — contributing ∆I = 0.205 bits of additional discriminative information beyond any individual cell. These findings motivate a fundamentally different representation: one that preserves section identity, ordering, and relational context as first-class dimensions. A second motivation for the present release is temporal. BODMAS [2], the most recent publicly available temporal benchmark, covers malware collected between August 2019 and September 2020. In the five years since that collection window closed, the malware landscape has changed substantially: new families such as LummaStealer, AsyncRAT, DarkGate, and Rhadamanthys have emerged and proliferated; the prevalence of commodity stealers and loaders distributed through malware-as-a-service platforms has increased; and evasion techniques targeting ML-based classifiers have become more sophisticated. PRISM is the first open benchmark to include PE malware samples from 2024–2025 collected from MalwareBazaar alongside re-processed BODMAS data, enabling evaluation against the contemporary threat environment. The contributions of this paper are: • PRISM representation. We define a 2D matrix M ∈ R(Nmax +1)×F that encodes each PE section as a row with F = 25 semantic features covering name encoding, size ratios, permission flags, entropy and entropy quartiles, positional index, and structural anomaly flags. An additional global summary row provides backward compatibility with EMBER-style models. • Multi-source contemporary corpus. We process malware binaries from BODMAS [2] (2019–2020), MalwareBazaar (2024–2025), VirusShare collection 00499, and historical CAPE sandbox samples, together with 29,467 benign executables from SOREL-20M, yielding 83,633 unique PRISM matrices after deduplication. A family-filtered primary corpus of 49,204 samples (19,737 malware with verified family labels across 684 families, plus 29,467 benign) supports all separability and baseline analyses. • Formal separability analysis. We provide a system-
atic measurement of Fisher Discriminant Ratio (FDR), Mutual Information (MI), and inter-cell information gain (∆I) at the (section index, feature type) granularity on the full 49,204-sample family-filtered corpus, demonstrating that the most discriminative positional feature (MEM_DISC@SEC5, FDR = 1.287) achieves a 1.50× higher FDR than any single dimension of the PRISM global summary row, and that 12,854 intersection feature pairs in the (section × feature) lattice carry non-trivial information gain (∆I > 0.01 bits) beyond any individual feature. • Five reference model configurations including a controlled cross-representation comparison. We train LightGBM [3] models under a strictly controlled protocol with explicit deduplication and zero train/test overlap: PRISMpool (PRISM per-section features mean-pooled across sections, position discarded, 25-dim), PRISMfull /PRISMsub (PRISM flattened, 425-dim, on the full corpus and on the EMBERcompatible sub-corpus respectively), PRISMtemporal (PRISM flattened under a BODMAS-malware temporal split, 425-dim), and EMBERsub (EMBER 1D, 2,381-dim, compared against PRISMsub on identical samples and splits). Including BODMAS via restored disarmed binaries, the cross-representation comparison over 20 deterministic splits shows that PRISM (425dim) attains binary-detection performance close to EMBER (2,381-dim) at one-sixth the dimensionality, conceding only a small, consistent gap (+0.85 pp TPR@FPR=0.1% in EMBER’s favour) confined to the deep-FPR tail, while remaining operationally indistinguishable at the decision threshold. • Open release. The dataset, the prism-extract extraction library, all baseline models, the controlled benchmark code, and the complete analysis pipeline are released under CC BY 4.0 and MIT licences respectively. The remainder of this paper is organised as follows. Section II surveys related datasets and feature representations. Section III formally defines the PRISM matrix and per-section feature set. Section IV describes the dataset construction pipeline. Section V presents the separability analysis. Section VI defines the baseline experimental configurations. Section VII reports and interprets the results. Section VIII compares PRISM against existing datasets. Sections IX and X outline conclusions and future directions. II. Related Work A. Public PE Malware Datasets The availability of large, labelled, and reproducible PE malware datasets has been a critical enabler of progress in static malware detection research. Prior to 2018, most published work relied on private or proprietary datasets, making comparison across papers unreliable and entry barriers for new researchers high.
Anderson and Roth [1] addressed this gap with EMBER, al. [8] provided a large-scale empirical study of malware the first large-scale open benchmark for static PE malware family classification, finding that family-level labels from detection. EMBER provides pre-extracted features for 1.1 antivirus tools are substantially noisy and that this million PE files scanned in or before 2018, together with an noise significantly affects benchmark validity — a finding open-source LIEF-based feature extractor and a LightGBM relevant to our family-filtered corpus protocol. baseline model. The 2,381-dimensional EMBER feature None of the datasets described above preserve section vector concatenates byte histogram, string features, general ordering as a first-class structural dimension. All represent file information, header features, section information, and each PE file as a single fixed-length vector, discarding the data directory fields into a single flat representation. The sequential and relational structure of the section table that EMBER vector has since become the de facto standard for is central to the PRISM design. PE malware feature engineering and the original paper one of the most heavily cited resources in the field. Joyce et B. Static Feature Representations Feature extraction strategies for static PE analysis span a al. [4] recently released EMBER2024, extending the corpus to 3.2 million files across six file formats and introducing a broad spectrum from raw bytes to semantically engineered “challenge set” of malware that initially evaded antivirus feature vectors. At one extreme, Rezaei et al. [9] demondetection. However, EMBER2024 retains the flat 1D vector strate that as few as 324 bytes of raw PE header content philosophy and does not expose section-level positional — comprising the DOS header, File Header, and Optional Header — contain sufficient discriminative information to structure. Yang et al. [2] introduced BODMAS, adding two critical train a deep embedding model achieving over 97% accuracy dimensions absent from EMBER: temporal labels and on balanced datasets. Their use of a joint deep embedding malware family annotations. BODMAS covers 57,293 and k-means clustering objective is particularly relevant to malware samples and 77,142 benign samples collected PRISM’s design philosophy: they show that unsupervised between August 2019 and September 2020, organised structural groupings in the embedding space align with chronologically so that researchers can study temporal malware/benign labels, suggesting that the PE header concept drift. The BODMAS paper demonstrated that encodes latent structural regularities that go beyond simple models trained on earlier samples lose significant detection feature engineering. Nakrošis et al. [10] apply convolutional networks directly capability when evaluated on later samples, motivating the temporal split evaluation we adopt for our PRISMtemporal to PE header byte sequences, treating the header as model (Section VI-D). BODMAS malware is distributed a one-dimensional signal and learning positional filters in disarmed form — with the PE Machine and Subsystem that capture local byte patterns. Their approach achieves header fields zeroed to prevent accidental execution — competitive accuracy without manual feature design, but rather than as feature vectors only; we show in Section VI-E at the cost of interpretability: the learned filters do not that these binaries can be restored and processed by the correspond to named fields or section boundaries. Maleki EMBER extractor, enabling BODMAS to be included in et al. [11] focus specifically on packed malware detection the controlled cross-representation benchmark. Abdulwa- through analysis of the PE section table — the closest hab et al. [5] confirmed this ranking on EMBER 2024, precursor to the PRISM representation. They observe that finding that LightGBM and XGBoost (AUC-ROC = 0.9979) packers introduce characteristic anomalies in section sizes, substantially outperform MLP and TabNet-based archi- virtual-to-raw size ratios, and permission flag combinations, tectures on the same 2,381-dimensional tabular feature and show that these anomalies can be detected by analysing set, with all pairwise differences statistically significant by the section table structure rather than byte content. PRISM generalises this insight by encoding section-table features McNemar’s test. Harang and Rudd [6] introduced SOREL-20M systematically across all sections and all feature dimensions, (Sophos/ReversingLabs-20 Million), scaling the public PE enabling both traditional ML and deep learning approaches benchmark to near-industrial size with approximately 20 to exploit the full relational structure of the section table. million samples, pre-extracted features, and approximately Yuk and Seo [12] and Yousuf et al. [13] provide comple10 million “disarmed” binaries — samples with executable mentary studies of combinations of PE header fields and headers zeroed to prevent accidental execution, following section statistics using traditional ML classifiers, confirming a methodology we adopt for the BODMAS portion of that section-level features consistently outperform headerour corpus. SOREL-20M addressed the training-size only features in binary classification tasks. Hasanah et limitations of EMBER but is computationally demanding al. [14] provide a recent systematic review of ML approaches and, like EMBER, provides only 1D feature vectors. to malware detection, identifying the lack of temporally The benign subset of SOREL-20M is the source of the diverse, openly available datasets as a key bottleneck benign corpus used in the present release. Yousuf et al. [7] for progress. All of the approaches surveyed, however, extended the feature set by constructing a dataset that aggregate section-level information into global statistics includes not only PE header and section features but before classification, discarding the positional context that also DLL names and imported function lists. Wang et PRISM preserves.
C. Image-Based and Hybrid Representations
TABLE I: PRISM per-section feature set. Total F = 25 dimensions per section row.
An orthogonal line of research converts PE binary Features Dim. content into greyscale images and applies CNN-based Group vision classifiers. Malik et al. [15] demonstrate that transfer Name enc. Section name hashed to 8-dim bin vector 8 learning from ImageNet-pretrained CNNs to malware Sizes 3 SizeOfRawData, VirtualSize, raw/virt ratio images achieves competitive classification accuracy on (log-scale) standard benchmarks. Hai et al. [16] integrate an image- Permissions READ, WRITE, EXEC, DISC, CODE, 6 DATA flags based malware detector (using MobileNetV2 and InceptionV3 fine-tuned on BODMAS) into a full endpoint Entropy Shannon entropy H of section byte content 1 detection and response system, showing that lightweight Quartiles Q2–Q4 entropy over 256-byte sliding windows 3 CNNs can achieve AUC above 0.86 at inference times Position Normalised section index i/Nmax 1 below 0.1 seconds per file. Yu et al. [17] and Zhao et Anomaly Unusual name; WX co-occurrence; zero raw 3 al. [18] explore more structured image representations that size partially preserve section boundaries. Total 25 While image-based approaches implicitly preserve some spatial structure, they do so without explicit section boundary semantics: a pixel at position (100, 50) in a where N max = 16 is the maximum number of sections malware image does not correspond to a named section or considered (the empirical 95th-percentile of section counts a specific feature dimension. This makes it difficult to apply across the corpus is P = 9, meaning that N 95 max = 16 interpretability tools such as Fisher Discriminant Ratio or covers 100% of all samples in the family-filtered corpus Mutual Information at the section-feature granularity, and while providing margin for outlier binaries — the full prevents direct compatibility with EMBER-style tabular justification and section-count distribution are presented models. El-Hajj [19] combines static and dynamic features in Section III-D), and F = 25 is the effective number of in a hybrid approach, noting that pure static analysis is features per row used in the analysis. insufficient for highly obfuscated malware and that dynamic Rows 0, . . . , N − 1 correspond to the N real PE sections features provide complementary signal. PRISM is designed in file order. Row N max is a global summary row compatible as a static analysis representation, but its 2D structure with EMBER-style models. Rows N, . . . , N max − 1 are is architecturally compatible with the addition of a third zero-padded, with a binary mask vector m ∈ {0, 1}Nmax +1 dimension for dynamic features — a direction we pursue indicating active rows. This design choice — a fixed-size in planned future work. matrix with explicit masking — allows PRISM matrices to be stacked into tensors for batch processing by deep D. Separability and Information Theory learning frameworks without dynamic padding. Kraskov et al. [20] introduced the k-nearest-neighbour B. Per-Section Feature Vector estimator for Mutual Information that we use in SecEach section row Mi , i < Nmax , is composed of seven tion V, providing a non-parametric estimator that avoids feature groups (Table I). the binning artefacts of histogram-based methods and is Note on feature schema. An earlier internal version of well-suited to high-dimensional continuous features. The the PRISM extractor included a first quartile (Q1) of consistent superiority of gradient-boosted classifiers over windowed entropy as a 26th feature; following a structural simpler models on EMBER-scale tabular PE features [1], redundancy analysis, this slot was removed because Q1 [2], [5] motivates our use of LightGBM as the classifier exhibits empirical correlation above 0.95 with both the byte family for all five baseline configurations. Our contribution entropy and Q2 features across the corpus, contributing extends this line of analysis to the (section index, feature no additional discriminative information. This compresses type) granularity, asking not merely which classifier family the per-section feature allocation from F = 26 to F = is most effective but which pairs of (section, feature) cells 25, yielding the 425-dimensional flattened representation across the matrix carry information beyond their individual components. This is, to our knowledge, the first systematic ((Nmax + 1) × F = 17 × 25) used in all baseline experiments. application of inter-cell Mutual Information gain analysis The reference implementation in prism-extract retains a reserved slot at index 22 for backward compatibility with to PE malware datasets. previously-extracted matrices, populated with zeros. All analyses in this paper operate on these F = 25 effective III. The PRISM Representation feature dimensions; this is reflected in the LightGBM input A. Formal Definition dimensionality reported in Section VI. Let a PE binary contain N sections (N ≥ 1). We define C. Global Row its PRISM matrix as Row Nmax encodes file-level summary features: norM ∈ R(Nmax +1)×F (1) malised section count, log-scaled import/export counts,
Fig. 2: Monthly distribution of BODMAS samples between August 2019 and September 2020. The split point used for the PRISMtemporal single-class temporal probe (Section VI-D) is the 80th-percentile first-seen timestamp of the BODMAS malware, 2020-07-25.
Fig. 1: Distribution of PE section counts by class on the 49,204-sample family-filtered corpus (29,467 SOREL benign, 19,737 family-labelled malware). Malware (red) shows a bimodal distribution with a primary peak at 3 sections and a secondary peak at 7 (section count 6 is a local minimum). Benign (blue) is sharply concentrated at 6 sections. Dashed lines indicate corpus-wide percentiles: P50 = 6, P90 = 8, P95 = 9, P99 = 12. Setting Nmax = 16 covers 100% of the corpus.
GPU resources. All 25 features are either directly available as LIEF attributes or computable from raw section byte content (entropy, quartiles), making the pipeline fully reproducible from the released prism-extract library. IV. Dataset Construction A. Malware Sources
The PRISM corpus draws from four complementary malware repositories, chosen to maximise temporal and family diversity while remaining fully reproducible from digital signature presence, and resource section presence. publicly accessible sources. BODMAS [2] contributes disarmed PE malware samThis row provides a self-contained EMBER-compatible global descriptor; it is included as part of the flattened ples collected between August 2019 and September 2020. PRISM vector (Section VI-B) and serves as one comparison Of the 57,218 disarmed binaries we obtained, 57,133 were arm — the per-section maximum versus the global-row successfully processed into PRISM matrices (85 failed maximum — in the separability analysis of Section V. Of extraction); these span 538 malware families after family the 25 feature slots in the global row, 5 are populated with filtering. The temporal distribution of BODMAS is shown these file-level descriptors and 20 are zero by construction. in Figure 2 and the family distribution in Figure 3. Binaries are distributed in disarmed form with the PE D. Design Rationale Machine and Subsystem header fields zeroed, following The choice of Nmax = 16 is justified empirically by the SOREL-20M [6] methodology; this does not affect the the section count distribution observed in our corpus. As PE section structure on which PRISM relies and is fully shown in Figure 1, the 50th percentile of section counts compatible with LIEF parsing. Unlike the feature-vectoris 6, the 90th percentile is 8, the 95th percentile is 9, and only releases, the availability of these binaries lets us restore the 99th percentile is 12. Setting Nmax = 16 therefore the zeroed header fields (Section VI-E) and extract native covers 100% of all samples in the family-filtered corpus EMBER vectors, so that BODMAS can be included in the without truncation, while keeping the matrix dimensions controlled cross-representation benchmark (specifically, in compact enough for efficient batch processing. The malware its BODMAS-inclusive confirmatory run; see Section VI-E). MalwareBazaar [22] contributes contemporary 2024– distribution is bimodal: a large proportion of samples have only 2–3 sections (consistent with simple packers that 2025 PE samples obtained via the abuse.ch public API. compress the original binary into a single payload section), Samples were retrieved by querying multiple malware while a tail extends to higher section counts (consistent family signatures (including LummaStealer, RemcosRAT, with modular malware or installers with multiple resource AsyncRAT, Emotet, DCRat, and NjRAT) and behavioural sections). The benign distribution, drawn from SOREL- tags (ransomware, stealer, loader, RAT, backdoor, banker, 20M, is much more concentrated, with the majority of dropper, botnet). This source is the contemporary anchor of the PRISM corpus, addressing the temporal gap identified samples having exactly 6 sections. The feature set was designed to be extractable using in Section I. LIEF [21] from any PE binary in under 50 ms on commodity VirusShare [23] collection 00499 contributes PE binahardware, enabling large-scale corpus construction without ries identified by MZ magic byte detection from a broader
TABLE II: PRISM corpus composition after deduplication and family filtering. Each matrix has shape 17 × 25. The family-filtered corpus (49,204 samples) is used for all separability and classification analyses in Sections V–VII. Stage
Count
Raw matrices combined (before deduplication) Unique matrices after global deduplication
178,740 83,633
Family-filtered primary analysis corpus Family-labelled malware (49,204 subset) SOREL benign (49,204 subset)
49,204 19,737 29,467
Distinct malware families Malware:benign ratio (family-filtered)
684 1 : 1.49
Fig. 3: Top 15 malware families in BODMAS by sample count. The corpus is dominated by commodity families (mira, sfone, ceeinject, berbew, small), which collectively account for over 30% of all BODMAS malware samples.
rows (ensuring reproducibility across runs), removed 53.2% of the matrices, reflecting the substantial overlap between repositories that draw from shared threat intelligence feeds; BODMAS, MalwareBazaar, and VirusShare all index widely distributed malware families within hours of first appearance, resulting in extensive cross-source duplication. file collection that included Android APKs, PDF docuAfter deduplication, 83,633 unique matrices remained. A ments, Office files, and other non-PE formats. VirusShare family filter was then applied to the malware portion: samples are included in the full deduplicated corpus but only samples carrying a verified family label from their excluded from the family-filtered primary analysis corpus, source metadata (BODMAS family CSV, MalwareBazaar because VirusShare collection 00499 does not provide perquery tag, or per-sample VirusTotal annotation for CAPE) sample family labels. were retained for the primary analysis corpus. The final CAPE historical samples were extracted from PRISM composition is summarised in Table II. We note that exactmatrices computed during previous internal CAPE sandbox matrix-hash deduplication removes only byte-identical runs, restricted to the static slice of each tensor. Family PRISM representations; it does not remove near-duplicate labels were available for the subset of CAPE samples for polymorphic variants whose matrices differ in a single which prior VirusTotal annotation existed; samples without cell. Residual near-duplicate leakage of this kind would family labels were excluded from the family-filtered corpus inflate the absolute detection metrics of the randomon the same basis as VirusShare. split models (PRISMpool , PRISMfull ); the PRISMtemporal temporal probe (Section VI-D) is included precisely to test B. Benign Source whether such within-window leakage drives the observed Benign PE files are drawn from the SOREL-20M benign saturation, and finds that it does not. distribution [6], yielding 29,467 unique benign matrices The full deduplicated corpus (n = 83,633) is released after deduplication. SOREL benigns are distributed in alongside the family-filtered corpus for researchers wishing disarmed form analogous to the SOREL malware portion, to train classifiers that do not require family-level annotapreserving the PE section table for LIEF parsing. This tions; all primary analyses in Sections V–VII operate on source provides a heterogeneous benign distribution spanthe 49,204-sample family-filtered subset. ning multiple compilers, toolchains, and source archives, supporting separability and classification analyses with E. Evaluation Subsets broad benign coverage. All experiments in this paper draw from the single 49,204-sample family-filtered corpus defined above. Three We implemented the PRISM extractor (prism-extract) subsets of it are used, distinguished only by which samples using LIEF 0.14.1 [21] on Ubuntu 24.04 with Python 3.12. participate; the per-sample features are identical across all The extraction pipeline processes each PE file in under three. We name them here so that the experimental section 50 ms on average on an 8-core VM with NVMe storage. (Section VI) can refer to datasets and representations The full deduplicated corpus and the family-filtered corpus separately from the models trained on them. statistics are reported in Section IV-D. 1) Full family-filtered set (n = 49,204): the entire D. Deduplication and Quality Control corpus (19,737 malware from BODMAS, CAPE, The combined raw collection comprised 178,740 candiand MalwareBazaar; 29,467 SOREL benign). Used date PRISM matrices across all sources. Exact deduplicawhenever no EMBER vector or timestamp constraint tion by feature matrix hash, using np.unique on flattened applies. C. Extraction Pipeline
TABLE III: Separability metrics on the 49,204-sample family-filtered corpus, comparing per-section positional features against the PRISM global summary row. The global column reports values for the 5 file-level descriptors populated in the global row; the remaining 20 slots are zero by construction. Per-section maximum
Global row maximum
Max FDR
1.287 (MEM_DISC@SEC5)
0.858 (log_exports)
1.50×
Max MI (bits)
0.522 (virt_size@SEC1)
0.357 (log_imports)
1.46×
Metric
Ratio
V. Separability Analysis
Fig. 4: Top 20 malware families in the family-filtered corpus by sample count. The corpus is dominated by mira (12.8%), sfone (10.1%), ceeinject (8.4%), berbew (7.0%), and small (6.5%), which collectively account for 44.8% of the familylabelled malware. The top 30 families cover 73.6% of familylabelled samples; the remaining 26.4% is distributed across 654 long-tail families.
2) Temporal-malware subset: the same corpus, but with the BODMAS malware ordered by first-seen timestamp so that a temporal train/test cut can be applied to that class only. The benign class (SOREL) carries no usable timestamp and is therefore always taken in full and split at random. Only the BODMAS malware is partitioned in time; no benign sample is ever removed. 3) EMBER-compatible subset (n = 32,623): the subset for which native EMBER 2,381-dim vectors can be extracted from raw binaries — SOREL benign (29,137), CAPE (3,110), and MalwareBazaar (376). BODMAS is absent from this subset in the primary form because its binaries require restoration first; once restored (Section VI-E), BODMAS adds 16,202 EMBER-valid samples, giving a BODMAS-inclusive variant of 48,825 samples used as a confirmatory check. This subset is the only one on which the PRISM and EMBER representations can be compared on identical samples. We emphasise that these are subsets and representations, not models. A model (always the same LightGBM, Section VI) becomes a named model only once it is trained on one of these subsets under one representation; the fullcorpus and EMBER-subset PRISM models, although they share the flattened PRISM representation, are distinct models trained on distinct sample sets and are reported as such.
We perform three complementary analyses to quantify the discriminative content of the per-section positional representation. All analyses operate on the full 49,204sample family-filtered corpus. A. Fisher Discriminant Ratio The Fisher Discriminant Ratio (FDR) measures the separability between two classes for a given feature as the ratio of between-class variance to within-class variance. We apply FDR not to individual features in isolation but to each (section index i, feature f ) pair independently: FDR(i, f ) =
(µ1 (i, f ) − µ0 (i, f ))2 σ12 (i, f ) + σ02 (i, f )
(2)
where µc and σc2 denote the class-conditional mean and variance of feature f at section position i for class c ∈ {0 (benign), 1 (malware)}. A high FDR value indicates that the feature takes systematically different values for malware and benign samples at that specific section position. The highest-discriminating individual (section, feature) pair is MEM_DISC@SEC5 (FDR = 1.287): the MEM_DISCARDABLE memory permission flag at section position 5. This reflects systematic differences between benign and malware in how discardable sections (typically .rsrc or .reloc content marked for discard after load) are positioned within the file: standard compiler toolchains place .reloc at consistent positions, while malware compilers and packers often produce different layouts. The top five (section, feature) pairs by FDR are MEM_DISC@SEC5 (1.287), name5@SEC3 (1.004), CNT_DATA@SEC4 (0.931), log_exports@GLOBAL (0.858), and CNT_DATA@SEC5 (0.853); Table III summarises the per-section versus global-row maxima for both FDR and MI, and Figure 5 shows the per-feature comparison. The concentration of discriminative power in sections 1 through 5 — with sections 7 and beyond contributing negligible signal — is the most robust qualitative finding of the FDR analysis.
(a) Maximum positional FDR per feature dimension (best of SEC0–SEC15).
Fig. 6: FDR (left) and MI (right) heatmaps over the full (17 × 25) feature space on the 49,204-sample familyfiltered corpus. Both heatmaps show discriminative power concentrated in sections SEC0–SEC5, with sections SEC7– SEC15 contributing negligibly. The FDR heatmap highlights MEM_DISC@SEC5 (top value 1.287) and the cluster around sections 3–5; the MI heatmap highlights size and entropy-quartile features (virt_size, ratio, Q2–Q4) concentrated at SEC0–SEC2. The ‘reserved’ column (slot 22, see Section III-B) is masked in grey.
in scikit-learn (mutual_info_classif, random_state=42, n_neighbors=5). We note that 9 of our 25 features are binary (the six permission flags READ, WRITE, EXEC, Fig. 5: Per-feature FDR comparison on the 49,204-sample DISC, CODE, DATA, and the three anomaly flags), for family-filtered corpus. (a) Maximum positional FDR per which the Kraskov–Stögbauer–Grassberger estimator may feature dimension (best of SEC0–SEC15). (b) FDR of exhibit known bias; mixed discrete–continuous MI estimaeach feature dimension in the PRISM global summary tors would provide refined values for those features and row (row index 16); the global row populates 5 of 25 are listed as a methodological refinement in Section X. MI slots with file-level descriptors, the remaining 20 zero by is computed independently for each feature–position pair construction. (c) Ratio of positional to global FDR for the (section index i, feature f ), following the same positional 5 populated global slots. The maximum positional FDR granularity used for FDR in Section V-A. (1.287, MEM_DISC@SEC5) is 1.50× the maximum globalThe results are visualised in Figure 6, which shows the row FDR (0.858, log_exports). FDR and MI values as heatmaps over the full (Nmax × F ) feature space. The top five (section, feature) pairs by MI are virt_size@SEC1 (0.522 bits), Q4@SEC0 (0.499), Interpretability of name* dimensions. Several high- entropy@SEC0 (0.495), Q3@SEC0 (0.494), and ratio@SEC1 ranking cells (e.g., name5@SEC3, name1@SEC*) are indi- (0.492). The MI ranking emphasises size, ratio, and entropy vidual bits of the 8-dimensional hashed section-name features at sections 0 and 1, in contrast to the FDR ranking projection rather than directly nameable PE fields. These which emphasises permission and name-encoding features dimensions should be read collectively, as evidence that at sections 3 to 5. Both rankings converge on the qualitative the distribution of section names at a given position differs claim that discriminative information is concentrated in systematically between classes (a known packer/compiler the first six section positions. signature), not as individually interpretable features. By The maximum MI attained by any (section, feacontrast, log_exports@GLOBAL, along with the permission ture) cell on the family-filtered corpus is 0.522 bits at flag (MEM_DISC), size (raw_size, virt_size), and entropy virt_size@SEC1, considerably higher than any populated cells that dominate the remaining rankings, map directly dimension of the global summary row; the highest globalonto semantically meaningful PE attributes. row MI is 0.357 bits (log_imports), yielding a positionalto-global MI ratio of 1.46×—consistent with the 1.50× B. Mutual Information FDR ratio reported in Section V-A. Mutual Information (MI) measures the statistical dependence between a feature and the class label, capturing C. Inter-Cell Information Gain (∆I) non-linear relationships that the linear FDR may miss. (i) (j) We estimate MI using the k-nearest-neighbour estimator Let d = fa − fb denote the cross-cell feature difference of Kraskov et al. [20] with k = 5, as implemented between cells (i, a) and (j, b) of the matrix, where cells refer (b) Global-row FDR (5 popu- (c) Positional-to-global FDR ralated slots). tio.
to (section index, feature index) positions. The inter-cell information gain is (j) ∆I = I(d; Y ) − max I(fa(i) ; Y ), I(fb ; Y )
(3)
where I(·; Y ) is the MI with the class label estimated under the same Kraskov k-NN procedure. The choice of (i) (j) the scalar difference d = fa −fb makes ∆I a deliberately conservative, single-degree-of-freedom probe of inter-cell structure: it asks whether the relative value of two cells is more informative than either cell alone, which is the specific relational quantity that a flat per-cell representation cannot encode. It is conservative precisely because it collapses the two cells onto a single additive contrast, capturing only the linear (difference) interaction between them and discarding any higher-order or non-additive dependence on Fig. 7: Top 20 inter-section feature pairs by ∆I on the (i) (j) the pair (fa , fb ) that the full joint distribution carries; 49,204-sample family-filtered corpus. Each bar represents a consequently ∆I can only under-report synergy, never pair of cells (section , feature )×(section , feature ) whose a a b b overstate it. It is not the full joint mutual information joint MI exceeds the best individual MI by the indicated (i) (j) I(fa , fb ; Y ), which would upper-bound ∆I and which margin. The top pair (raw_size@SEC2, name5@SEC3) we leave to the refined estimation discussed in Section X; contributes ∆I = 0.205 bits. the difference probe is preferred here because it is cheap to estimate over all 85,000 inter-section pairs and yields an interpretable lower bound on the synergy present in The systematic presence of ∆I > 0.01 in 15.1% of all the lattice. Consistent with the inter-section motivation of inter-section (section, feature) cell pairs constitutes the PRISM, we restrict ∆I to pairs of cells lying in different central representational finding of the separability analysis: section rows (including the global summary row as one discriminative information is widely distributed across “section”): with Nmax + 1 =17 rows and F = 25 effective the (section × feature) lattice in a form that requires 2 features per row, this is 17 joint observation of two cells to be detected. Because a 2 × 25 = 136 × 625 = 85,000 unordered inter-section cell pairs. Pairs of features within global aggregation collapses each feature across sections a single section are excluded by construction, as the cross- into a single file-level statistic, this position-dependent section relationship is the quantity a flat 1D aggregation relational signal is not recoverable from the EMBER-style destroys. Of these, 62,950 pairs (74.1%) exhibit ∆I > 0 global vector — although, as the saturation analysis of bits, 12,854 pairs (15.1%) exhibit ∆I > 0.01 bits, and Section VII-B shows, recovering it confers no advantage 2,215 pairs (2.6%) exhibit ∆I > 0.05 bits. The maximum on the binary task once a position-free aggregate of the ∆I = 0.205 bits is attained by the pair (raw_size@SEC2, same features already saturates the metric. name5@SEC3); the mean ∆I across pairs above the 0.01 D. Entropy Profile by Section Position threshold is 0.033 bits. The entropy-by-position profile (Figure 8) shows that The top 20 pairs by ∆I are shown in Figure 7. Several patterns are visible: (i) cross-section pairs involving both benign and malware classes start at near-equal entropy raw_size at one section and a name-encoding feature at section 0 (benign ≈ 0.76, malware ≈ 0.75), with the at a different section appear repeatedly in the top 20 two profiles separating in subsequent sections in patterns (e.g., raw_size@SEC2 × name5@SEC3, raw_size@SEC1 consistent with the structural distinctions documented by × raw_size@SEC3, raw_size@SEC2 × name1@SEC5), FDR and MI. The present profile, computed on SORELsuggesting that the joint structure of size progression derived benigns from heterogeneous compilers, exhibits a and naming across sections carries information unavail- dispersed structure that is robust to compiler choice. able from any individual cell; (ii) pairs involving the Statistical test of per-position separation. Visual global summary row appear (e.g., raw_size@SEC2 × inspection of Figure 8 suggests modest divergence between name0@GLOBAL, name3@SEC1 × name0@GLOBAL), the benign and malware entropy distributions beyond indicating that file-level descriptors and positional fea- section 0, but the heterogeneous SOREL-derived benign tures carry partially complementary signal; (iii) the mix produces wide ±1σ bands and makes the magnitude ∆I signal extends to non-adjacent section pairs (e.g., of any underlying distributional difference difficult to judge raw_size@SEC1 × raw_size@SEC4, MEM_READ@SEC5 by eye. To place the visual observation on a quantitative × virt_size@SEC6), confirming that limiting analysis footing without overclaiming, we apply a two-sample to adjacent transitions would miss substantial structural Kolmogorov–Smirnov (KS) test at each section position information. i ∈ {0, 1, . . . , 15}, comparing the per-sample entropy
TABLE IV: Two-sample Kolmogorov–Smirnov test of benign vs. malware Shannon entropy distributions at each section position on the 49,204-sample family-filtered corpus. Holm–Bonferroni correction is applied over the 16 simultaneous tests at α = 0.05. D is the KS statistic (bounded in [0, 1], larger = greater distributional separation). All 16 positions reject H0 at the corrected level.
Fig. 8: Entropy profile by PE section position on the 49,204sample family-filtered corpus. Both classes start near the same level at section 0 (benign ≈ 0.76, malware ≈ 0.75). Beyond section 0 the two profiles diverge, with benign exhibiting greater dispersion across sections (consistent with the more heterogeneous compiler and toolchain mix in the SOREL benign distribution) and malware showing a flatter, slightly lower mean profile. Shaded bands are ±1 standard deviation.
Pos
nben
nmal
SEC0 SEC1 SEC2 SEC3 SEC4 SEC5 SEC6 SEC7 SEC8 SEC9 SEC10 SEC11 SEC12 SEC13 SEC14 SEC15
29,467 29,467 29,381 26,354 26,322 24,696 6,498 1,993 1,120 769 452 329 198 194 190 187
19,737 19,720 19,203 13,474 9,758 6,754 5,203 3,122 1,775 742 587 263 229 191 179 165
D
pHolm
0.485 < 10−300 0.262 < 10−300 0.391 < 10−300 0.412 < 10−300 0.441 < 10−300 0.319 < 10−300 0.443 5.3 × 10−321 0.350 1.2 × 10−131 0.348 2.0 × 10−73 0.400 1.3 × 10−53 0.313 4.5 × 10−22 0.422 3.5 × 10−23 0.597 6.0 × 10−35 0.439 6.6 × 10−17 0.454 3.3 × 10−17 0.454 7.2 × 10−17
distributions of the benign and malware populations on the full 49,204-sample family-filtered corpus. The KS statistic is non-parametric, makes no assumption about distribution shape, and detects any departure between the two empirical assess the contribution of the PRISM representation under CDFs (location, scale, or higher moments). We report a strictly controlled experimental protocol. All models the per-position KS statistic Di and the two-sided p- use LightGBM [3] as the classifier — a gradient-boosted value, applying Holm–Bonferroni correction across the 16 decision tree framework that has been the standard choice simultaneous tests to control the family-wise error rate for tabular PE malware classification since the original at α = 0.05. Active-row counts per position decline with EMBER paper [1] and that provides a strong and wellsection index (from nbenign = 29,467, nmalware = 19,737 understood reference point. Table V summarises the five at SEC0 to nbenign = 187, nmalware = 165 at SEC15), configurations at a glance; the subsections that follow reflecting the section-count distribution of Figure 1. describe each in detail, and Section VI-G states the three The null hypothesis of distributional equality is rejected hypotheses these models are designed to test. at every section position after Holm–Bonferroni correction (all corrected p < 10−16 ; corrected p-values at the most A. Common Protocol populated positions SEC0–SEC5 underflow IEEE double precision). The KS statistic itself, which is bounded in [0, 1] All baselines use the following LightGBM hyperand serves as a non-parametric effect-size measure, ranges parameters: 1,000 max estimators, learning rate 0.05, from D = 0.262 at SEC1 to D = 0.597 at SEC12, with a num_leaves 63, min_child_samples 20, early stopping at mean of D = 0.408 across the 16 positions (Table IV). The 50 rounds without improvement, random_state=42, and largest separations occur at SEC12 (D = 0.597), SEC0 scale_pos_weight set to the class ratio of the relevant (D = 0.485), SEC15 (D = 0.454), and SEC14 (D = 0.454). training set. Train/test splits are deterministic: 80/20 stratThese effect sizes are consistent with the qualitative reading ified per class, generated with numpy.random.seed(42). of Figure 8: a real but moderate distributional shift between Train/test row overlap after deduplication is verified to be classes that is not visually dramatic in mean-and-band zero for every baseline. plots but is highly statistically robust given the large perPRISMpool and PRISMfull operate on the full 49,204position sample sizes available in the family-filtered corpus. sample family-filtered corpus. PRISMtemporal re-splits that The result formally confirms that the entropy-by-position same corpus with a single-class temporal cut: BODMAS structure carries discriminative content at every section malware is split by first-seen timestamp at the 80th perposition, consistent with the broader FDR and MI patterns centile (2020-07-25), while the SOREL benigns, which carry documented in Sections V-A–V-B. no usable timestamp, are split at random (Section VI-D). EMBERsub (and its PRISM counterpart PRISMsub ), inVI. Experimental Baselines troduced for the controlled cross-representation compariWe define five model configurations (two of which share son, operate on the EMBER-compatible sub-corpus (Secthe PRISM flattened representation on different corpora) to tion VI-E).
TABLE V: Summary of the five model runs, grouped by aggregate of each PRISM matrix: the column-wise mean the three contrasts of Section VI-G. The primary cross- of the section rows, collapsing the (N max × F ) per-section representation comparison (PRISMsub vs. EMBERsub ) block to a single 25-dimensional vector with the same shares one EMBER-compatible sub-corpus and one split; feature semantics as PRISM full but no positional structure. the within-PRISM ablation (PRISMpool vs. PRISMfull ) This mean-pooled vector retains the marginal distribution shares the full family-filtered corpus and one split; of every per-section feature (mean name-hash occupancy, PRISMtemporal is the temporal probe. The three axes that mean size, mean entropy, mean quartiles, mean permission vary are feature representation, corpus, and split protocol; rates) while discarding which section each value came from. the classifier (LightGBM) and hyperparameters are held PRISM pool is trained and evaluated on the identical full fixed throughout. family-filtered corpus and split as PRISMfull , so any performance difference between PRISMpool (25-dim, positionModel Representation Corpus / split Dim free) and PRISMfull (425-dim, positional) is attributable Contrast 1 — PRISM vs. EMBER (cross-representation, same exclusively to the per-section positional structure that samples): flattening preserves and mean-pooling destroys. PRISMsub
PRISM flattened
425 Sub-corpus 32,623 (SOREL + CAPE + MBZ); random 80/20, seed 42
D. Model PRISMtemporal : PRISM under a Single-Class Temporal Probe (BODMAS malware)
PRISMtemporal applies the same PRISM 425-dimensional classifier as PRISMfull , but replaces the random split with a temporal one on the BODMAS malware, to probe whether Contrast 2 — within-PRISM ablation (positional vs. position- the saturation seen under random splitting is inflated by discarded, same features): leakage between near-duplicate samples collected close in PRISMpool PRISM per-section Full family-filtered 25 time. BODMAS malware is ordered by first-seen timestamp and cut at the 80th percentile (2020-07-25): malware before features, (49,204); random mean-pooled 80/20, seed 42 that date trains, malware on or after it tests (Figure 2). We (position discarded) are explicit about an important limitation: the temporal Full family-filtered 425 split applies only to the malware class. The benign class is PRISMfull PRISM flattened (per-section + global (49,204); random SOREL-20M, which carries no usable first-seen timestamp, row) 80/20, seed 42 so benigns are split at random (80/20). PRISMtemporal is Contrast 3 — single-class temporal probe (malware only): therefore a single-class temporal check, not a fully temporal 425 protocol; the exact per-class composition is train = 12,984 PRISMtemporal PRISM flattened BODMAS malware temporal (split 2020malware (temporal) + 23,573 benign (random) = 36,557, 07-25) + SOREL test = 3,247 malware (temporal) + 5,894 benign (random) benign random; = 9,141. We report the outcome of this probe, and discuss 36,557/9,141 the extent to which it supports the absence of temporalwindow leakage, in Section VII-B. B. Model PRISMfull / PRISMsub : PRISM Flattened E. Model EMBERsub : Controlled Cross-Representation PRISMfull (and its sub-corpus variant PRISMsub ) is a Benchmark (EMBER 1D vs. PRISM) LightGBM classifier trained on PRISM matrices flattened EMBERsub is the EMBER arm of the controlled crossto a 17 × 25 = 425-dimensional vector by concatenating representation experiment. To compare the PRISM 2D all section rows in order. This flattening preserves the representation against the EMBER 1D representation positional information — the features of SEC0 occupy under maximally fair conditions—identical samples, idendimensions 0–24, SEC1 occupies dimensions 25–49, and so on — while making the representation compatible with tical train/test split, identical classifier hyperparameters— standard tabular classifiers that expect a fixed-length input both representations must be extracted from the same vector. PRISMfull operates on the full 49,204-sample family- set of raw PE binaries. All four malware sources in filtered corpus; the sub-corpus variant PRISMsub uses our corpus provide binaries suitable for EMBER extracthe same representation on the 32,623-sample EMBER- tion. SOREL-20M, CAPE, and MalwareBazaar provide compatible subset (Section VI-E). The 80/20 split yields them directly; BODMAS provides disarmed binaries (PE 39,363 training samples (15,790 malware, 23,573 benign) Machine and Subsystem header fields zeroed), which we and 9,841 test samples (3,947 malware, 5,894 benign); restore with a small utility that rewrites those two fields (Machine → 0x014c, Subsystem → 2) before extraction. We scale_pos_weight = 1.493. verified that restoration is necessary and sufficient for C. Model PRISMpool : Position-Discarded Mean Aggregate EMBER: on the disarmed binaries, 47 of the 2,381 EMBER To isolate the specific contribution of per-section position, features deviate from their restored values — 3 in the we train a LightGBM model on a position-discarded general group, 5 in section, and 39 in imports (with EMBERsub
EMBER 1D
Sub-corpus 32,623; identical split to PRISMsub
2,381
TABLE VI: Sample composition of each model by source. PRISMpool and PRISMfull share the full family-filtered corpus; PRISMtemporal re-splits that corpus with a single-class temporal cut on BODMAS malware (2020-07-25, the 80th-percentile first-seen timestamp) while SOREL benigns are split at random; PRISMsub and EMBERsub use the EMBER-compatible sub-corpus. VirusShare and MalwareBazaar (legacy) are part of the full deduplicated pool but are excluded from the family-filtered corpus, as they lack verified family labels. Dashes denote sources not present in a model. Model (split) PRISMpool / PRISMfull (full family-filtered)
BODMAS CAPE MalwareBazaar SOREL-20M Malware (malware) (malware) (modern, mal.) (benign) total 16,231
3,130
376
Total
29,467
19,737
49,204
PRISMtemporal — single-class temporal probe (BODMAS malware temporal; SOREL benign random): train 12,984 — — 23,573 test 3,247 — — 5,894
12,984 3,247
36,557 9,141
PRISMsub / EMBERsub — EMBER-compatible sub-corpus, primary run (controlled cross-representation, 20 seeds; BODMAS not included): total — 3,110 376 29,137 3,486 32,623 train (seed 42) — — — 23,310 2,789 26,099 test (seed 42) — — — 5,827 697 6,524 PRISMsub / EMBERsub (BODMAS-inclusive) — confirmatory run (restored BODMAS binaries added; single seed): total 16,202 3,110 376 29,137 19,688
48,825
Notes. (i) PRISMsub and EMBERsub share this identical EMBER-compatible sub-corpus (SOREL, CAPE, MalwareBazaar) and split, differing only in representation (PRISM 425-dim vs. EMBER 2,381-dim); the confirmatory BODMAS-inclusive run (Section VI-E) adds 16,202 BODMAS samples with valid EMBER vectors for a 48,825-sample corpus. The full family-filtered corpus lists 16,231 BODMAS PRISM matrices; the 29-sample difference is BODMAS binaries whose EMBER vector could not be extracted, so they enter the PRISM-only full corpus but not the BODMAS-inclusive cross-representation run. (ii) Sub-corpus malware = 3,110 CAPE + 376 MalwareBazaar = 3,486; of an initial 32,973 candidates, 350 (1.06%) failed EMBER extraction. (iii) The primary multi-seed study repeats the comparison over 20 stratified splits (seeds 42–61) on this same 32,623-sample sub-corpus.
Machine = 0, LIEF fails to parse the import table, cor- confirmatory comparison (which we label Path A) adds rupting the imports_4 bucket that carries the highest the restored BODMAS samples, giving the full 48,825gain), while the byte-histogram and byte-entropy groups sample EMBER-valid family-filtered corpus (16,202 BODare unaffected; on the restored binaries all 47 recover their MAS with valid EMBER vectors join the 32,623, minus correct values. EMBER extraction requires both a binary residual failures). Throughout the paper, “Path A” refers (to restore) and a paired PRISM matrix; of the 57,133 to this BODMAS-inclusive confirmatory run, in which the BODMAS PRISM matrices, 75 lack a binary on disk, disarmed BODMAS binaries are restored and EMBERleaving 57,058 EMBER candidates. Extraction on these extracted (Section VI-E) so that BODMAS, previously restored BODMAS binaries succeeds for 57,033 of 57,058 excluded for lack of usable binaries, can join the controlled (99.96%; the 25 failures are unrelated LIEF parse errors). comparison. We report this comparison on two corpora. The primary comparison is a 20-seed robustness study on the F. Evaluation Protocol and Metrics 32,623-sample EMBER-compatible sub-corpus drawn from For the primary comparison both representations SOREL-20M, CAPE, and MalwareBazaar (this is the are trained and evaluated under 20 independent sub-corpus for which an EMBER checkpoint was first stratified 80/20 splits (seeds 42–61), with LightGBM available); of an initial 32,973 candidates, 350 (1.06%) forced into deterministic mode (num_threads=1, failed EMBER extraction under LIEF 0.14 due to an force_row_wise=true, deterministic=true) and 1 unpatched compatibility gap (lief.not_found attribute), scale_pos_weight set per split to the training leaving 32,623 validated samples (29,137 SOREL benign; malware:benign ratio. For each split we record 3,486 malware = 3,110 CAPE + 376 MalwareBazaar). The TPR@FPR=0.1%, AUC-ROC, and a paired McNemar test of the two models’ hard predictions on the shared 1 The EMBER feature extractor used here was originally developed for LIEF 0.9; this work uses LIEF 0.14. Two monkey- test set. Multiple seeds are essential here: at FPR=0.1% patches were applied to enable extraction: (a) NumPy type alias the operating threshold on a ∼5,800-benign test set is patch (np.int/np.float/np.bool → corresponding Python builtins, fixed by only a handful of false positives, so a single split addressing deprecations in NumPy 1.24+); and (b) LIEF exception class patch (lief.bad_format/bad_file/pe_error → bare yields a [email protected]% estimate with a standard error of Exception, addressing reorganisation between LIEF 0.9 and 0.14). A several tenths of a percentage point — larger than the residual gap (lief.not_found) caused the 1.06% extraction failure effect being measured. Reporting the distribution of the rate. Feature values may differ slightly between LIEF versions; these paired difference across splits, rather than one split’s point differences are negligible at the saturation regime documented in Section VII. estimate, is what makes the comparison reproducible.
For PRISMpool and PRISMfull on the full corpus, and for the single-seed confirmatory runs, we additionally compute 95% bootstrap confidence intervals on TPR@FPR=0.1% using 1,000 resamples of the test set with replacement. We caution that at FPR=0.1% the metric resolution is approximately one false positive per 1,000 benigns, so a single split’s bootstrap interval is wide and an apparent overlap between two single-split intervals is a weak, optimistic criterion for equivalence; the 20-seed paired analysis of Section VII supersedes it for the primary comparison. G. Experimental Design and Hypotheses The five baseline configurations are not evaluated as independent points on a leaderboard. They are designed to support three contrasts, each posing a distinct, testable question about binary malware/benign classification. We state the hypotheses explicitly here, before the results, and we order them by centrality to the paper’s claim: the primary cross-representation question first, the withinPRISM ablation second, and the temporal safeguard third. This ordering separates the experimental design from the interpretation that follows in Section VII-B. a) Contrast 1 (primary): PRISMsub vs. EMBERsub — PRISM vs. EMBER, sample-controlled.: The central question of this paper is how closely the PRISM representation, which preserves per-section structure at 5.6× lower dimensionality, can approach the established EMBER representation on the binary detection task. We compare them on an identical EMBER-compatible sub-corpus over 20 independent splits, with identical LightGBM hyperparameters; the only manipulated variable is the feature vector itself (PRISM flattened, 425 dimensions, vs. EMBER 1D, 2,381 dimensions). Path A removes the previous binaryavailability obstacle, so we additionally confirm the comparison on the full BODMAS-inclusive corpus. Hypothesis 1: PRISM attains binary-detection performance close to EMBER’s at a fraction of the dimensionality on the same samples; any residual gap is small and confined to the deep-FPR tail. b) Contrast 2 (within-PRISM ablation): PRISMpool vs. PRISMfull — positional vs. position-discarded.: Having established how PRISM compares to EMBER, we ask what the per-section position contributes within PRISM. This contrast uses the full family-filtered corpus (n = 49,204), same 80/20 random split, same classifier, same hyperparameters, and the same underlying per-section features. The only manipulated variable is whether position is retained: PRISMpool mean-pools the section rows into a single 25dimensional position-free vector, while PRISMfull keeps the full flattened matrix (425 dimensions) with position encoded by row offset. Any performance difference is attributable exclusively to the per-section positional structure. Hypothesis 2: retaining per-section position adds measurable binary-detection signal beyond a position-discarded mean aggregate of the same features.
c) Contrast 3 (single-class temporal probe): PRISMtemporal — PRISM under a malware-temporal split.: PRISMtemporal uses the PRISM representation (not EMBER) and does not enter a paired comparison with PRISMsub or EMBERsub . Its role is exploratory: to probe whether the saturation observed in Contrast 1 under a random split is partly an artefact of leakage between near-duplicate BODMAS-era samples collected close in time. We split BODMAS malware temporally (training before 2020-07-25, testing on or after) while benigns, lacking timestamps, are split at random, and observe whether PRISM remains saturated. As detailed in Section VI-D, the single-class nature of this split and the benign-source confound limit its evidential weight. Hypothesis 3 (weak form): PRISM does not collapse under a malware-temporal split; we do not claim this establishes full temporal generalisation, which a timestamped benign source would be required to test. d) Anticipated objection: can a 25-dim position-free aggregate really match a 425-dim positional matrix and a 2,381-dimensional EMBER vector?: A naive reading of Contrast 2 might suggest that a negative result (PRISMpool statistically indistinguishable from PRISMfull , and from EMBERsub ) would imply the extra dimensions are uninformative. This is not the correct reading. PRISMpool is not an arbitrary low-dimensional model: mean-pooling preserves the full marginal distribution of every per-section feature — mean entropy, mean size, mean permission rates, mean section-name occupancy — and discards only where in the file each value occurs. The signal that saturates the binary task (a binary’s aggregate import/entropy/size profile) survives this aggregation almost intact; only the positional refinement is lost. EMBER’s own gain analysis on EMBERsub confirms that binary detection concentrates in a few structural-identity features: a single import-hash bucket (imports_4) accounts for gain 419,167, approximately 5.5× the second-ranked feature. Saturation at TPR@FPR=0.1% ≈ 0.99 is therefore a property of the binary classification task under gradient-boosted tabular classifiers, on a family-filtered corpus in which signed benign software is well represented — not a property of the input dimensionality, and not evidence that position is uninformative in general. The separability analysis of Section V establishes that the per-section positional information PRISM preserves is real and statistically robust (peak FDR 1.50× that of the global row; KS rejection of benign-vs-malware distributional equality at all 16 section positions; 12,854 inter-section pairs carrying ∆I > 0.01 bits). That information is reserved for tasks with greater metric headroom — family-level multi-class, 2D-aware architectures, adversarial robustness — where the binarysaturation ceiling does not constrain measurement. Section VII reports the empirical outcomes of all three contrasts, beginning with the primary PRISM-vs-EMBER comparison. Section VII-B interprets the joint pattern in
terms of representational saturation under gradient-boosted tabular classifiers.
matrices. Table VIII shows a representative split (seed 42) on the 6,524-sample sub-corpus test set (5,827 benign / 697 malware); the small false-negative difference shown there is within the per-split variation documented above and should not be read as a systematic cost-balanced advantage for either model. In this split both models commit exactly 2 false positives at threshold 0.5 (FPR = 0.034%), with 6 false negatives for PRISMsub and 10 for EMBERsub out of 697 malware; across the 20 splits neither model holds a consistent advantage at threshold 0.5 (McNemar median p = 0.06), in contrast to the deep-tail metric where EMBER leads consistently. The two representations thus differ measurably only in the extreme low-FPR regime. c) Within-PRISM ablation (Contrast 2).: Having characterised how PRISM compares to EMBER, we isolate the contribution of the per-section structure within PRISM. On the full family-filtered corpus, PRISMpool (per-section features mean-pooled across sections, position discarded, 25dim) reaches AUC-ROC = 0.99980 and TPR@FPR=0.1% = 0.9949, while PRISMfull (full flattened matrix, 425dim, position retained) reaches AUC-ROC = 0.99980 and TPR@FPR=0.1% = 0.9924. The two are statistically indistinguishable on the binary task; their bootstrap CIs ([0.9704, 0.9980] for PRISMpool and [0.9578, 0.9962] for PRISMfull ) overlap almost entirely. In binary classification at this saturation level, retaining per-section position adds no measurable detection signal over a position-free mean aggregate of the same features — a result we interpret in Section VII-B and which must be read against the anticipated objection addressed in Section VI-G: it reflects metric saturation, not absence of structural information. d) Single-class temporal probe (Contrast 3).: PRISMtemporal applies the PRISM 425-dim classifier with a temporal split of the BODMAS malware (training before 2020-07-25, testing on or after) and a random split of the SOREL benigns. The result (AUC-ROC = 0.99970, TPR@FPR=0.1% = 0.9969) shows that PRISM does not collapse under a malware-temporal split. We read this cautiously: because only the malware class is temporally separated and the benign source is, as the source probe below shows, trivially separable, PRISMtemporal is consistent with the absence of temporal-window leakage but does not establish full temporal generalisation. It is supporting evidence, not a decisive safeguard; a timestamped benign source would be needed for a complete test.
VII. Results A. Quantitative Results Table VII reports the five model runs. We present the results in the order of the contrasts defined in Section VI-G: the primary cross-representation comparison first (PRISMsub vs. EMBERsub ), the within-PRISM ablation second (PRISMpool vs. PRISMfull ), and the singleclass temporal probe last (PRISMtemporal ). a) Primary result — a small, consistent EMBER edge in the deep tail; operational parity (Contrast 1).: The controlled cross-representation comparison is the central result of the paper, and we report it over 20 independent deterministic splits rather than one, because at FPR=0.1% a single split’s TPR estimate is dominated by a handful of false positives. Across the 20 splits, PRISMsub (425dim) attains TPR@FPR=0.1% = 0.9887 ± 0.0058 and EMBERsub (2,381-dim) attains 0.9971 ± 0.0019. EMBER is ahead in all 20 splits, by a mean of ∆ = +0.85 pp (range +0.14 to +2.15 pp); a Wilcoxon signed-rank test on the paired per-split differences rejects equality (p < 10−4 , paired t-test p ≈ 9 × 10−6 ). This is a real, reproducible advantage, and we state it plainly: EMBER retains a small but systematic edge over PRISM in the deep-FPR tail. At the same time, the advantage is confined to that tail: a paired McNemar test on the two models’ hard predictions on the shared test set does not reject at the conventional level in most splits (median p = 0.06; significant in 9 of 20), so the two representations are operationally indistinguishable at the decision threshold. The earlier single-seed reading (seed 42: ∆ = +0.14 pp with overlapping bootstrap CIs) corresponds to one of the splits most favourable to PRISM and should not be generalised — a concrete illustration of why the multi-seed protocol is necessary. The practical takeaway is that PRISM recovers essentially all of EMBER’s binary-detection performance, falling short only marginally and only in the extreme lowFPR regime, while using 5.6× fewer input dimensions and preserving an interpretable per-section structure that EMBER discards. b) Confirmation with BODMAS included (Path A).: Lifting the BODMAS exclusion (Section VI-E) and re-running the comparison on the full 48,825-sample corpus reproduces the same ordering: PRISMsub (BODMAS-inclusive) reaches AUC-ROC = 0.99965 and TPR@FPR=0.1% = 0.9975, EMBERsub B. Interpretation of the Saturation Regime The empirical pattern observed in Section VII admits (BODMAS-inclusive) reaches AUC-ROC = 0.99999 and TPR@FPR=0.1% = 0.9987, a difference of +0.127 three complementary interpretations that map onto the pp in the same direction. The BODMAS-inclusive corpus three hypotheses stated in Section VI-G. Observation 1 (answers Hypothesis 1): PRISM thus does not change the conclusion; we report it as a single-seed confirmation and note that a full multi-seed 425-dim nearly matches EMBER 2,381-dim, with repetition on the expanded corpus is the natural next step. a small consistent tail gap. Over 20 splits, EMBER At the operationally relevant decision threshold of 0.5, leads PRISM in TPR@FPR=0.1% in every split, by a the two representations produce nearly identical confusion mean of +0.85 pp (Wilcoxon p < 10−4 ), yet the two
TABLE VII: Model results, grouped by the three contrasts of Section VI-G. Contrast 1 (PRISMsub vs. EMBERsub ) is reported as mean ± std of TPR@FPR=0.1% over 20 deterministic stratified splits (seeds 42–61) on the 32,623-sample sub-corpus, with the BODMAS-inclusive Path A run shown as a single-seed confirmation. Contrast 2 (PRISMpool vs. PRISMfull ) is the within-PRISM positional ablation on the full corpus. Contrast 3 (PRISMtemporal ) is the single-class temporal probe. EMBER holds a small but consistent advantage in TPR@FPR=0.1% across all 20 splits (∆ = +0.85±0.62 pp, Wilcoxon p < 10−4 ), while the two are operationally indistinguishable at threshold 0.5 (paired McNemar median p = 0.06). Model
n_train / n_test
Corpus
Input dim
Contrast 1 — PRISM vs. EMBER cross-representation (same samples): PRISMsub 32,623-sample 26,099 / 6,524 425 (20-seed) sub-corpus EMBERsub (20-seed)
32,623-sample sub-corpus
26,099 / 6,524
2,381
AUCROC
TPR @ FPR=0.1%
TPR @ FPR=1%
0.9994
0.9887 ± 0.0058
0.9957
0.9999
0.9971 ± 0.0019
1.0000
0.9975 / 0.9987
0.9992 / 1.0000
0.99980
0.9949
0.9987
Confirmation on the full BODMAS-inclusive corpus (Path A, single seed): 48,825-sample / 39,060 / 9,765 425 / 2,381 0.9997 / 1.0000 full corpus
PRISMsub EMBERsub
Contrast 2 — within-PRISM positional ablation (same features, full corpus): PRISMpool Full family-filtered 39,363 / 9,841 25 (mean-pooled) PRISMfull (flat- Full family-filtered tened)
39,363 / 9,841
425
0.99980
0.9924
0.9987
Contrast 3 — single-class temporal probe (malware only): BODMAS mal. temporal 36,557 / 9,141 PRISMtemporal + SOREL ben. random (malwaretemporal)
425
0.99970
0.9969
0.9997
TABLE VIII: Confusion matrices for PRISMsub and EMBERsub on the sub-corpus test set (6,524 samples) at decision threshold 0.5, for a single representative split (seed 42). Both commit identical false-positive counts (FP = 2); the four-sample false-negative difference is within the per-split variation reported in Section VII and is not a systematic effect. Model
TN
FP
FN
TP
PRISMsub EMBERsub
5,825 5,825
2 2
6 10
691 687
are indistinguishable at the decision threshold (McNemar median p = 0.06). PRISM therefore recovers nearly all of EMBER’s binary-detection performance using 5.6× fewer features while preserving an interpretable per-section structure that EMBER lacks, conceding only a marginal, tail-confined gap. This is primarily a representationalefficiency result, directly attributable to the design choice of preserving structural identity rather than aggregating into byte-histogram and string-bucket statistics that the gradient-boosted classifier must then implicitly reconstruct; the residual gap suggests EMBER’s far larger feature set still captures a little additional deep-tail signal that the compact PRISM vector does not. Observation 2 (answers Hypothesis 2 negatively,
in this regime): a position-discarded mean aggregate already saturates the binary task under tabular classifiers. PRISMpool (25-dim, per-section features meanpooled across sections) achieves AUC = 0.99980 and TPR@FPR=0.1% = 0.9949 on the full family-filtered corpus — within the bootstrap confidence interval of the 425-dim PRISMfull trained on the same corpus and split (TPR@FPR=0.1% = 0.9924, 95% CI [0.9578, 0.9962]). Because PRISMpool retains the same features as PRISMfull and differs only in discarding section position, this isolates position as the manipulated variable: the mean persection feature profile carries essentially all the binary discrimination available to a tabular classifier in this regime. Hypothesis 2 is therefore not supported under flat-vector gradient-boosted classification on this corpus: per-section positional structure does exist and is statistically richer (see Observation 3), but its additional signal cannot manifest while the position-free aggregate already saturates the metric. As emphasised in Section VI-G, this is a statement about metric saturation in binary classification, not about the absence of structural information. Observation 3 (reconciles Observations 1 and 2 with the separability analysis): separability content is real and present but not exploited by flat-vector tabular classifiers. Section V documents that positional features carry substantially more per-feature discriminative content (1.50× higher maximum FDR than the global row’s
Kraskov MI estimator bias for binary features. The MI estimator used in Section V-B may produce biased estimates for the 9 binary features in the PRISM vector. A mixed discrete–continuous estimator (Ross 2014 or Gao et al. 2017) would refine those values; we have not re-run the analysis with that estimator in the present release. BODMAS disarming and restoration. BODMAS binaries are distributed disarmed (Machine and Subsystem zeroed). We restore these two fields before EMBER extraction; on the disarmed form, 47 of 2,381 EMBER features deviate (chiefly 39 import features, because LIEF fails to parse the import table when Machine = 0), all of which recover on the restored binaries. While restoration is faithful for the affected header and import features and leaves the byte-histogram and byte-entropy groups untouched, it is a reconstruction rather than the original vendor binary; a fully matched reproduction from neverdisarmed BODMAS binaries would be the technically cleanest version of the BODMAS portion of the crossrepresentation benchmark. The multi-seed primary comparison (Section VII) is computed on the non-BODMAS sub-corpus and is unaffected by this caveat; the BODMASinclusive run is reported as confirmation only. Single-seed BODMAS-inclusive run. The 48,825sample BODMAS-inclusive comparison is reported for a single split, whereas the primary sub-corpus comparison uses 20 seeds. A multi-seed repetition on the expanded corpus is left to a revision; the single-seed expanded result is directionally consistent with the multi-seed sub-corpus result. Source provenance and disarming asymmetry (threat to validity for absolute metrics). Benign and malware samples in this corpus are drawn from disjoint repositories: every benign sample originates from SOREL20M, and no malware sample does. The disarming status is likewise asymmetric — SOREL and BODMAS samples are distributed in disarmed form (subsystem and machine header fields zeroed), whereas CAPE and MalwareBazaar binaries are not; in the EMBER-compatible sub-corpus specifically, the benign class is entirely disarmed SOREL while the malware class (CAPE + MalwareBazaar) is not. A classifier can in principle exploit such provenance and preprocessing artefacts as a shortcut for the label, and we confirm this empirically: a LightGBM trained to predict the source (SOREL vs. non-SOREL) rather than the label achieves AUC = 0.99988, essentially identical to C. Limitations the malware detector’s own AUC. Source and label are thus LIEF version compatibility for EMBERsub . The near-perfectly collinear in this corpus, and the detector EMBER extractor was originally developed for LIEF 0.9 cannot be distinguished from a provenance classifier on and is run here under LIEF 0.14 with two compatibility the available data. We consider this the most likely explapatches (footnote 1). EMBER itself emits a warning nation for the very high absolute operating point (AUC about possible feature-value differences between LIEF ≈ 0.9999), which sits far above the EMBER2018 reference. versions. At the saturation regime documented above, The dominance of an import-hash bucket (imports_4) these differences are expected to be negligible, but a and a header field (header_28) in the EMBERsub gain fully matched reproduction under LIEF 0.9 would be the ranking is consistent with this concern. Crucially, this technically cleanest version of this experiment. confound does not undermine the two controlled compar-
maximum) and that 12,854 inter-section pairs carry joint information beyond any individual cell. This structural information does not manifest in binary classification metrics at the saturation point because LightGBM operating on flattened features cannot exploit the 2D structure (it sees the matrix as an unordered bag of 425 scalars), and because binary classification at AUC ≈ 0.9999 leaves no headroom for additional signal to manifest. The structural information becomes consequential under (i) 2D-aware architectures (CNN, ViT, GNN) that can natively exploit the matrix structure; (ii) fine-grained classification tasks (family-level multi-class with 684 classes provides substantially more headroom); (iii) adversarial and concept-drift evaluation, where representational richness affects robustness. Observation 4 (answers Hypothesis 3, weak form): no dominant temporal-window leakage artefact, but not a proof of temporal generalisation. Under the single-class temporal split (Section VI-D), PRISMtemporal reaches AUC-ROC = 0.99970 and TPR@FPR=0.1% = 0.9969 on the 2020 test fold — it does not collapse, which is consistent with the absence of leakage between nearduplicate samples collected close in time. We do not overread this. Only the malware class is temporally separated; the benign class (SOREL) is split at random and, as the source probe above shows, benign provenance is itself trivially separable, so a model can sustain high apparent performance without genuinely generalising across the malware time axis. PRISMtemporal therefore supports, but does not by itself establish, that the PRISM–EMBER nearequivalence of Observation 1 is free of temporal leakage; a timestamped benign source would be required for a decisive test, which we identify as future work. A qualitative convergence between the dominant features of the two representations supports the equivalence claim of Observation 1. The EMBERsub model’s top feature by gain is imports_4 (gain 419,167 — approximately 5.5× the second-ranked feature), an import-hash bucket. The PRISMfull model’s top three features by gain are log_exports@GLOBAL (the global-row slot encoding logscaled export count), entropy@SEC0, and Q4@SEC1. In both representations, structural identity features (encoding the binary’s imports/exports profile and section-level entropy distribution) dominate the gain importance: the two representations capture the same underlying signal through different encodings.
TABLE IX: Comparison of open PE malware datasets. Unique samples
Year
2D repr.
2024–25 data
EMBER [1]
1.1M
2018
No
No
BODMAS [2]
134K
2021
No
No
SOREL-20M [6]
20M
2020
No
No
EMBER2024 [4]
3.2M
2025
No
Yes
Dataset
Multi-feature [7]
18K
2022
No
No
PRISM (ours)
83,633
2026
Yes
Yes
(49,204 family-filtered)
isons that carry the paper’s claims: in both PRISMsub vs-EMBERsub (cross-representation) and PRISMpool -vsPRISMfull (within-PRISM ablation), the compared models are trained and tested on the identical samples, splits, and labels, so any provenance shortcut is shared equally between them and cancels in the comparison. The confound therefore inflates the shared ceiling but leaves the relative conclusions — the near-equivalence of PRISM and EMBER, and the saturating role of the position-free per-section aggregate — intact. It does, however, mean that the absolute detection numbers in this paper must not be read as field performance estimates; a source-balanced corpus (benign and malware from a common feed) is required before any absolute detection claim is made, and we identify this as essential future work. Single deterministic split. All baselines use one 80/20 split generated with seed=42. The bootstrap confidence intervals quantify test-set sampling variability but not split-selection variability. Repeated-split or stratified kfold validation, and multiple seeds, would tighten the variance estimates; given the saturated regime we expect the qualitative conclusions to be stable, but we have not verified this across splits in the present release. VIII. Comparison with Related Datasets PRISM is, to our knowledge, the first open PE malware dataset to provide a structured 2D matrix representation in which rows correspond to explicit PE sections in file order and columns correspond to named semantic feature dimensions, preserving section identity as a first-class addressable axis. While image-based representations [15], [16], [17], [18] preserve spatial structure implicitly through pixel arrangement, they do not expose section boundaries or named feature dimensions as addressable units, and therefore do not support per-section interpretability tools such as the FDR and MI heatmaps presented in Section V. PRISM also includes PE malware samples from 2024– 2025 collected from MalwareBazaar alongside re-processed BODMAS data, addressing the temporal coverage gap identified in Section I.
IX. Conclusion We have introduced PRISM (PE Relational Inter-Section Matrix), an open dataset and 2D feature representation for static Windows PE malware detection. PRISM encodes each binary as a structured matrix in which rows correspond to PE sections in file order and columns correspond to named semantic feature dimensions, preserving the positional structure that flat 1D representations discard. Our separability analysis on the 49,204-sample familyfiltered corpus provides quantitative evidence that the per-section structural information preserved by PRISM is statistically detectable. The most discriminative individual feature (MEM_DISC@SEC5) achieves a Fisher Discriminant Ratio of 1.287, 1.50× higher than the maximum attained by any single dimension of the global summary row. Across the (section × feature) lattice, 12,854 intersection pairs carry information gain ∆I > 0.01 bits beyond either component alone, with the top pair (raw_size@SEC2 × name5@SEC3) contributing ∆I = 0.205 bits. These findings provide formal evidence that the 2D structure preserves discriminative information unavailable to 1D representations. At the classifier level, the controlled cross-representation comparison (PRISMsub vs. EMBERsub on an identical 32,623-sample sub-corpus over 20 deterministic splits) yields a small but consistent advantage for EMBER in the deep-tail metric: ∆TPR@FPR=0.1% = +0.85 ± 0.62 pp, with EMBER ahead in all 20 splits (Wilcoxon p < 10−4 ). At the decision threshold the two are operationally indistinguishable (paired McNemar median p = 0.06), and including BODMAS via restored binaries on the full 48,825-sample corpus reproduces the same ordering (+0.127 pp, single seed). PRISM thus recovers nearly all of EMBER’s binary-detection performance using 5.6× fewer features (425 vs. 2,381) and a persection interpretable structure, conceding only a marginal, tail-confined gap. We are explicit that this near-equivalence is established in a saturated regime: the within-corpus comparison between PRISMfull (425-dim, positional) and PRISMpool (25-dim, position-discarded mean aggregate) is statistically indistinguishable, indicating that a position-free aggregate already saturates the binary detection task on this corpus under gradient-boosted decision trees. The high absolute operating point should be read with the provenance caveat of Section VII (a sourcevs-label probe reaches AUC = 0.9999) firmly in mind: these are not field performance estimates. All baselines converge at AUC-ROC ≳ 0.9997 and TPR@FPR=0.1% ∈ [0.989, 0.997], establishing the saturation level for static binary classification on the family-filtered PRISM corpus and motivating the move to representations and tasks with genuine metric headroom. The structural information preserved by PRISM — documented quantitatively by the separability analysis — is positioned to become consequential under architectures that
can natively exploit the 2D matrix structure (convolutional networks, vision transformers, graph neural networks) and in fine-grained tasks (family classification, temporal drift, adversarial robustness) where binary metrics do not saturate. The integration of complementary dynamic features as a third tensor dimension is the natural next step in the research programme. The PRISM dataset, the prism-extract extraction library, all trained models, the controlled crossrepresentation benchmark code, and the complete analysis pipeline are publicly available at https://github.com/ drjmsacristan/prism-dataset, with the PRISM feature matrices and baseline models permanently archived and citable via Zenodo at https://doi.org/10.5281/zenodo.20480349. X. Future Work
binary task — is the integration of complementary dynamic behavioural features. Refined MI estimation for binary features. Rerun the Section V-B MI analysis with a mixed discrete– continuous estimator (Ross 2014 or Gao et al. 2017) for the 9 binary features in PRISM. Low-cost refinement that improves the precision of the separability table without changing qualitative conclusions. Adversarial robustness evaluation. As PRISM-based classifiers are developed, evaluating their robustness to adversarial PE manipulation becomes important. The structural information PRISM preserves may make positionalaware models more robust to manipulations that 1D models miss, or conversely may expose new attack surfaces. Cross-corpus and concept-drift evaluation. Train on the PRISM corpus and evaluate on contemporary samples from MalwareBazaar 2025–2026, or evaluate temporal drift within the corpus using the BODMAS timestamps. Drift evaluation rewards representations that preserve generalisable structure. BODMAS-equivalent re-collection. Acquire raw PE binaries for samples temporally equivalent to BODMAS (2019–2020), enabling sample-matched cross-representation comparison on BODMAS-era malware. The current EMBER-compatible sub-corpus excludes BODMAS because of the binary-availability constraint; closing that gap would extend the cross-representation comparison to the most temporally-controlled benchmark available. Provenance-controlled evaluation. Construct a source-balanced split in which benign and malware samples are drawn from a shared feed, and train an auxiliary probe to predict source rather than label, in order to bound the residual provenance and disarming signal identified in Section VII. This is a prerequisite for any absolute detection claim from the corpus and is independent of the (provenance-robust) controlled comparisons reported here. Multi-seed confirmation on the expanded corpus. The 20-seed paired analysis (with McNemar tests) is reported here for the non-BODMAS sub-corpus; extending it to the full BODMAS-inclusive 48,825-sample corpus, and adding a two one-sided test (TOST) against a pre-registered tail margin, would complete the statistical characterisation of the small EMBER advantage observed across splits.
Several directions extend naturally from the contributions of this paper. We list them in order of expected impact. 2D-aware deep learning architectures. The baselines presented in this paper deliberately treat the PRISM matrix as a flattened 1D vector to enable controlled comparison against EMBER and the global-row proxy under standard tabular classifiers. The natural next step is to evaluate architectures that exploit the 2D structure natively: convolutional networks with kernels over the (section, feature) plane; vision transformers with sectionlevel attention modelling long-range cross-section dependencies; and graph neural networks that represent the section sequence as a directed graph with feature-level edges. The separability analysis of Section V documents the discriminative content these architectures could exploit; the present binary classification results suggest they will not produce gains on the binary task at the present saturation point but are positioned to produce gains on fine-grained tasks. Family-level classification. With 684 distinct families in the family-filtered corpus and a heavy-tailed distribution (top-5 families cover 44.8%, top-30 cover 73.6%), the corpus supports multi-class evaluation. Family-level metrics will not saturate as readily as binary metrics; we expect the PRISM structural information to be more clearly advantageous at this granularity. 3D extension with dynamic features. The PRISM Acknowledgements matrix is designed to accommodate a natural extension to three dimensions by incorporating dynamic analysis The authors thank the teams behind EMBER, BODfeatures — API call sequences, memory access patterns, MAS, SOREL-20M, MalwareBazaar (abuse.ch), and and network behaviour indicators — as additional layers VirusShare for making their datasets available to the realongside the existing static per-section features. This ex- search community. BODMAS feature vectors were provided tension is currently under active development with a target by Limin Yang and Gang Wang (University of Illinois corpus of 30,000 malware and 30,000 benign samples under Urbana-Champaign) following their data sharing agreecontrolled sandbox execution. The cross-representation ment. MalwareBazaar API access was provided by abuse.ch. comparison (PRISMsub vs. EMBERsub ) suggests that the SOREL-20M benign samples were made available through most likely source of additional discriminative signal — Sophos and ReversingLabs under the original data sharing given that static representations have saturated on the terms. The work of A.I.G.-T. is supported by project
PID2023-150310OB-I00, funded by MCIU/AEI/FEDER UE, Spain. References [1] H. S. Anderson and P. Roth, “EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models,” Apr. 2018. [2] L. Yang, A. Ciptadi, I. Laziuk, A. Ahmadzadeh, and G. Wang, “BODMAS: An Open Dataset for Learning-Based Temporal Analysis of PE Malware,” in 2021 IEEE Security and Privacy Workshops (SPW). San Francisco, CA, USA: IEEE, May 2021, pp. 78–84. [3] G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T.-Y. Liu, “LightGBM: A Highly Efficient Gradient Boosting Decision Tree,” in Advances in Neural Information Processing Systems 30 (NeurIPS 2017). Long Beach, CA, USA: Curran Associates, Inc., 2017, pp. 3146–3154. [4] R. J. Joyce, G. Miller, P. Roth, R. Zak, E. Zaresky-Williams, H. Anderson, E. Raff, and J. Holt, “EMBER2024 — A Benchmark Dataset for Holistic Evaluation of Malware Classifiers,” in Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2. Toronto, ON, Canada: ACM, Aug. 2025, pp. 5516–5526. [5] S. S. Abdulwahab, M. Z. Abdullah, and A. H. Sallomi, “Real-time malware prevention using gradient boosted decision trees on the EMBER 2024 dataset: A static analysis approach for Windows PE binaries,” International Journal of Intelligent Engineering and Systems, vol. 19, no. 6, pp. 748–762, 2026. [6] R. Harang and E. M. Rudd, “SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detection,” Dec. 2020. [7] M. I. Yousuf, I. Anwer, T. Shakir, M. Siddiqui, and M. Shahid, “Multi-feature Dataset for Windows PE Malware Classification,” Oct. 2022. [8] Q. Wang, H. Yan, C. Zhao, R. Mei, Z. Han, and Y. Zhou, “Measurement of Malware Family Classification on a Large-Scale Real-World Dataset,” in 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). Wuhan, China: IEEE, Dec. 2022, pp. 1390–1397. [9] T. Rezaei, F. Manavi, and A. Hamzeh, “A PE header-based method for malware detection using clustering and deep embedding techniques,” Journal of Information Security and Applications, vol. 60, p. 102876, Aug. 2021. [10] A. Nakrošis, I. Lagzdinytė-Budnikė, A. PaulauskaitėTarasevičienė, G. Paulikas, and P. Dapkus, “Deep LearningBased Malware Detection Using PE Headers,” in Information and Software Technologies (ICIST 2022), ser. Communications in Computer and Information Science, A. Lopata, D. Gudonienė, and R. Butkienė, Eds. Cham: Springer International Publishing, 2022, vol. 1665, pp. 3–18. [11] N. Maleki, M. Bateni, and H. Rastegari, “An Improved Method for Packed Malware Detection using PE Header and Section Table Information,” International Journal of Computer Network and Information Security, vol. 11, no. 9, pp. 9–17, Sep. 2019. [12] C. K. Yuk and C. J. Seo, “Static Analysis and Machine LearningBased Malware Detection System using PE Header Feature Values,” International Journal of Innovative Research and Scientific Studies, vol. 5, no. 4, pp. 281–288, Oct. 2022. [13] M. I. Yousuf, I. Anwer, A. Riasat, K. T. Zia, and S. Kim, “Windows malware detection based on static analysis with multiple features,” PeerJ Computer Science, vol. 9, p. e1319, Apr. 2023. [14] N. I. Hasanah, G. P. Insany, I. L. Kharisma, and N. D. Rahayu, “Recent Advancements in Machine Learning Models for Malware Detection: A Systematic Literature Review,” in The 7th International Global Conference Series on ICT Integration in Technical Education & Smart Society. MDPI, Sep. 2025, p. 78. [15] I. M. Malik Matin, I. Hermawan, S. D. Yulianti, I. A. Ahmad, Naurah, and Z. Azizah, “Image Representation Based Malware Detection Using Transfer Learning,” in 2025 IEEE Conference on Cloud and Big Data Computing (CBDCom). Hakodate, Japan: IEEE, Oct. 2025, pp. 136–142.
[16] T. H. Hai, V. Van Thieu, T. T. Duong, H. H. Nguyen, and E.-N. Huh, “A Proposed New Endpoint Detection and Response With Image-Based Malware Detection System,” IEEE Access, vol. 11, pp. 122 859–122 875, 2023. [17] Y. Yu, B. Cai, K. Aziz, X. Wang, J. Luo, M. S. Iqbal, P. Chakrabarti, and T. Chakrabarti, “Semantic lossless encoded image representation for malware classification,” Scientific Reports, vol. 15, no. 1, p. 7997, Mar. 2025. [18] Y. Zhao, C. Guo, Y. Ping, Y. Chen, Y. Cui, and G. Shen, “MCPDS: Image-based malware classification method using PE metadata alone,” Cybersecurity, vol. 9, no. 1, p. 34, Feb. 2026. [19] M. I. El-Hajj, “Hybrid Malware Classification using Static and Dynamic Features with Machine Learning,” in 2025 12th International Conference on Wireless Networks and Mobile Communications (WINCOM). Riyadh, Saudi Arabia: IEEE, Nov. 2025, pp. 1–8. [20] A. Kraskov, H. Stögbauer, and P. Grassberger, “Estimating mutual information,” Physical Review E, vol. 69, no. 6, p. 066138, Jun. 2004. [21] R. Thomas, “LIEF — Library to Instrument Executable Formats,” https://github.com/lief-project/LIEF, 2017, version 0.14.1. [22] abuse.ch, “MalwareBazaar — A Project from abuse.ch,” https: //bazaar.abuse.ch/, 2020, accessed: May 2025. [23] J.-M. Godwin, “VirusShare.com,” https://virusshare.com/, 2012, accessed: May 2025.