Open Access

ARTICLE

PE-MILCon: Multiple-Instance Learning with Contrastive Multi-View Representation for Static Windows PE Malware Detection

Tuan Nguyen Kim^1,*, Son Doan Trung¹, Nguyen Minh Nhut Pham²

1 Phenikaa School of Computing, Phenikaa University, Duong Noi, Hanoi, Vietnam
2 Vietnam-Korea University of Information and Communication Technology, The University of Danang, Danang, Vietnam

* Corresponding Author: Tuan Nguyen Kim. Email:

(This article belongs to the Special Issue: Malware Analysis, Forensics, and Detection Using Artificial Intelligence)

Computers, Materials & Continua 2026, 89(1), 43 https://doi.org/10.32604/cmc.2026.084268

Received 22 April 2026; Accepted 04 June 2026; Issue published 13 August 2026

Abstract

Static Windows Portable Executable (PE) malware detection remains a significant challenge due to the growing use of packing, obfuscation, and code reuse techniques, which gradually reduce the effectiveness of signature-based and manually engineered feature approaches. Recent deep learning models that operate directly on binary code or static features have achieved encouraging results; however, most still rely on global file-level representations. Such approaches are susceptible to noise introduced by padding or obfuscation and may overlook localized malicious regions. Moreover, many multi-view methods process different feature sources independently, lacking mechanisms to enforce semantic consistency across views. This paper proposes PE-MILCon, a malware detection framework that integrates Multiple-Instance Learning (MIL) with contrastive multi-view representation learning across raw byte segments and structural PE features. In PE-MILCon, each executable file is modeled as a “bag” of byte segments. The attention mechanism within MIL enables the model to focus selectively on suspicious regions rather than treating the entire file uniformly. In parallel, structural and semantic PE features are encoded as a complementary view. A contrastive loss function aligns the two representations within a shared semantic space, enhancing robustness against obfuscation and packing techniques. The proposed framework operates entirely on static analysis and is trained end-to-end. Experiments on large-scale PE datasets under a strict time-based evaluation protocol show that PE-MILCon achieves an ROC-AUC above 0.98 and an F1-score of approximately 0.96, demonstrating competitive performance compared with existing models. In addition, instance-level attention weights provide intuitive indications of important code regions, supporting malware inspection and forensic analysis. These results suggest that PE-MILCon offers an effective, robust, and interpretable approach for static malware detection.

---

Keywords

---