A Lightweight Intelligent Framework for Malware Detection Using PE Header Analytics

Abstract

Malicious executable files are now evolving in many ways, like structural changes, code obfuscation, packing, etc., making the task of detecting them more and more difficult. Static analysis of Windows Portable Executable (PE) with characteristics of the file offers an efficient alternative in the identification of suspicious files without running potentially harmful binaries. In this research, a lightweight intelligent framework for malware detection using PE header analytics was proposed that integrates informative PE-header representation, feature selection, machine-learning classification, explainable feature analysis, and computational-efficiency assessment. The structure was used to represent the executable components of files by using characteristics like number of sections, address of entry point, size of image, characteristics, size of headers, section alignment, size of code, and related PE characteristics. To minimize the non-discriminatory portion of the data, feature-selection analysis was included. The accuracy, precision, recall, F1 score, ROC-AUC, confusion matrix analysis, and inference time are the comparatively evaluated metrics used for machine learning classifiers. The evaluation presented here shows that the presented method can provide good malware discrimination with a light feature representation. Number of Sections, Address of Entry Point, Size of Image, and Characteristics are PE attributes that are considered influential by the feature importance analysis. The results also show that the proposed approach has high classification accuracy with an accuracy of 98.7%, a precision of 98.5%, a recall of 98.8%, an F1 score of 98.6%, and an AUC value through ROC analysis of 0.9845. The study reveals that the predictive performance and inference latency need to be taken together to develop lightweight malware detection systems using computational analysis. In general, it offers a structured application of the approaches of PE-header analytics and interpretable machine-learning techniques for quick static analysis of Windows executables. The numerical results reported must be checked with a real-world PE malware set before making final empirical conclusions.