# Knowledge-Based Dataset for Training PE Malware Detection Models

arXiv: https://arxiv.org/abs/2301.00153 · HTML: https://mlsanity.com/paper/2301.00153/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Dec 2022.

## Built on by (most cited first, 2 of 2)

- [PN-OWL: A Two Stage Algorithm to Learn Fuzzy Concept Inclusions from OWL Ontologies](https://mlsanity.com/paper/2303.07192/) (2023)
- [Explainable Malware Detection with Tailored Logic Explained Networks](https://mlsanity.com/paper/2405.03009/) (2024)

## Abstract (arXiv)

Ontologies are a standard for semantic schemata in many knowledge-intensive domains of human interest. They are now becoming increasingly important also in areas until very recently dominated by subsymbolic representations and machine-learning-based data processing. One such area is information security, and more specifically malware detection. We propose PE Malware Ontology that offers a reusable semantic schema for Portable Executable (PE, Windows binary format) malware files. The ontology was inspired by the structure of the data in the EMBER dataset and it currently covers the data intended for static malware analysis. With this proposal, we hope to achieve: a) a unified semantic representation for PE malware datasets that are available or will be published in the future; (b) applicability of symbolic, neural-symbolic, or otherwise explainable approaches in the PE Malware domain that may lead to improved interpretability of results which may now be characterized by the terms defined in the ontology; and (c)by joint publishing of semantically treated EMBER data, including fractional datasets, also improved reproducibility of experiments.