How Few Features Are Enough? Compact, Interpretable and Error-Aware Static Detection of Malicious PE Files from Structural Attributes

Abstract— Static detectors based on Portable Executable (PE) structural attributes are attractive as fast pre-filters, butpublished studies mostly maximise accuracy with high-capacity models. We study how much performance compact,directly interpretable models retain on a public benchmark of 138,047 PE files described by 54 header, section, importand resource attributes, under leakage-aware evaluation. A depth-2 decision tree reading three fields reaches 97.7% holdout accuracy, and logistic regression 97.5% with eleven attributes and 98.1% with all 54, against 99.5% for an unrestrictedrandom forest; repeated group-aware cross-validation yields consistent estimates. At default thresholds, models of similaraccuracy differ by a factor of two in false-positive rate, and all compact models raise about 5 to 11 times more falsealarms than the reference forest. The accuracy of an eleven-attribute model is stable across folds, but the identity of itsattributes is not. Because all benign files are Windows system binaries, the learned rules expose provenance shortcuts,which do not replicate on two further datasets. On the recent, time-split EMBER2024 benchmark, the same compactmodels reach only 77–82% accuracy, against 95% for the forest, and miss most evasive malware. All results arebenchmark estimates, not real-world detection rates.