Search papers, labs, and topics across Lattice.
The paper introduces PRISM, a novel dataset and feature representation for static Windows PE malware detection that utilizes a two-dimensional matrix to encode the relational context and ordering of PE sections, contrasting with existing one-dimensional vector representations. By analyzing a corpus of over 83,000 deduplicated matrices from various malware sources, the authors demonstrate that this structural representation retains critical discriminative information that flat representations overlook. The results show that a gradient-boosted classifier using PRISM achieves nearly equivalent detection performance to the larger EMBER vector while significantly reducing dimensionality, indicating potential for improved efficiency in malware classification tasks.
PRISM reveals that a two-dimensional representation of PE files can match the detection performance of larger, traditional models while drastically reducing dimensionality.
We introduce PRISM (PE Relational Inter-Section Matrix), an open dataset and feature representation for static Windows PE malware detection. Existing benchmarks such as EMBER, BODMAS, and SOREL-20M represent each PE file as a flat one-dimensional feature vector, discarding the ordering of sections and the relational context between them. PRISM instead encodes every binary as a two-dimensional matrix whose rows are individual PE sections in file order, with a global summary row that preserves compatibility with EMBER-style models. We build the corpus from four malware sources (BODMAS, MalwareBazaar, VirusShare, and CAPE) together with SOREL-20M benign software, yielding 83,633 deduplicated matrices and a family-filtered analysis corpus of 49,204 samples across 684 malware families. A formal separability analysis (Fisher Discriminant Ratio, mutual information, and inter-section information gain) shows that the per-section positional structure carries discriminative information that flat representations cannot capture. Under a strictly controlled, sample-matched comparison, a gradient-boosted classifier on the compact PRISM representation recovers nearly all of the binary-detection performance of the same classifier on the much larger EMBER vector, at roughly one-sixth the dimensionality; EMBER retains only a small, consistent advantage confined to the extreme low-false-positive regime, the two being operationally indistinguishable at the decision threshold. We are explicit that this binary task is saturated, so the structural content PRISM preserves is reserved for tasks with greater metric headroom, such as family classification and architectures that exploit the 2D structure directly. The dataset, extraction library, trained models, and full analysis pipeline are released under CC BY-NC-SA and MIT licences.
