<scp>PE</scp> Malware Detection via Optimized Static Features and Ensemble Learning

ABSTRACT In recent years, static feature analysis of portable executable (PE) files has emerged as a prominent research focus in cybersecurity for malware detection. This paper presents an innovative detection method that systematically extracts key structural features from PE file headers, including DOS headers, PE file headers, optional headers, and section tables. By integrating visual analysis techniques such as kernel density estimation, our approach effectively demonstrates significant structural differences between malicious and benign files ( p &lt; 0.01). During feature processing, we introduce an embedded feature selection algorithm that reduces feature space dimensionality by 30% while maintaining 99% classification accuracy. To build upon this feature processing strategy, our proposed two‐level stacking ensemble architecture leverages the complementary strengths of base classifiers, including random forest and gradient boosting decision tree. Experimental results indicate that the framework achieves 99.37% detection accuracy with an AUC of 99.6% on standard benchmark datasets. Cross‐dataset validation on a large‐scale test set comprising 138,148 samples further confirms the method's robustness, yielding 99.38% accuracy. Furthermore, comparison with state‐of‐the‐art methods demonstrates three distinct advantages of our approach: First, the information entropy‐based feature selection method reduces computational complexity by 42%. Second, the optimized model ensemble strategy improves the F 1‐score by 2.3%. Finally, the modular architecture enhances real‐time performance, achieving a detection throughput of 1500 files per second. These innovations establish a robust and efficient technical framework that enhances endpoint security protection against malware threats.