Submit

Login Login

Register Register

Home / Journals / CMC / Online First / doi:10.32604/cmc.2026.084268
Journal Menu
Special Issues
Table of Content

All issues

Online First

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Open Access

ARTICLE

PE-MILCon: Multiple-Instance Learning with Contrastive Multi-View Representation for Static Windows PE Malware Detection

Tuan Nguyen Kim1,*, Son Doan Trung1, Nguyen Minh Nhut Pham2
1 Phenikaa School of Computing, Phenikaa University, Duong Noi, Hanoi, Vietnam
2 Vietnam-Korea University of Information and Communication Technology, The University of Danang, Danang, Vietnam
* Corresponding Author: Tuan Nguyen Kim. Email: email
(This article belongs to the Special Issue: Malware Analysis, Forensics, and Detection Using Artificial Intelligence)

Computers, Materials & Continua https://doi.org/10.32604/cmc.2026.084268

Received 22 April 2026; Accepted 04 June 2026; Published online 16 July 2026

Abstract

Static Windows Portable Executable (PE) malware detection remains a significant challenge due to the growing use of packing, obfuscation, and code reuse techniques, which gradually reduce the effectiveness of signature-based and manually engineered feature approaches. Recent deep learning models that operate directly on binary code or static features have achieved encouraging results; however, most still rely on global file-level representations. Such approaches are susceptible to noise introduced by padding or obfuscation and may overlook localized malicious regions. Moreover, many multi-view methods process different feature sources independently, lacking mechanisms to enforce semantic consistency across views. This paper proposes PE-MILCon, a malware detection framework that integrates Multiple-Instance Learning (MIL) with contrastive multi-view representation learning across raw byte segments and structural PE features. In PE-MILCon, each executable file is modeled as a “bag” of byte segments. The attention mechanism within MIL enables the model to focus selectively on suspicious regions rather than treating the entire file uniformly. In parallel, structural and semantic PE features are encoded as a complementary view. A contrastive loss function aligns the two representations within a shared semantic space, enhancing robustness against obfuscation and packing techniques. The proposed framework operates entirely on static analysis and is trained end-to-end. Experiments on large-scale PE datasets under a strict time-based evaluation protocol show that PE-MILCon achieves an ROC-AUC above 0.98 and an F1-score of approximately 0.96, demonstrating competitive performance compared with existing models. In addition, instance-level attention weights provide intuitive indications of important code regions, supporting malware inspection and forensic analysis. These results suggest that PE-MILCon offers an effective, robust, and interpretable approach for static malware detection.

Keywords

Malware detection; multiple-instance learning; contrastive learning; multi-view learning; static analysis; portable executable; deep learning; cybersecurity

  • 77

    View

  • 9

    Download

  • 0

    Like

Related articles
Copyright© 2026 Tech Science Press
© 1997-2026 TSP (Henderson, USA) unless otherwise stated

Share Link