# Use of Multi-CNNs for Section Analysis in Static Malware Detection

arXiv: https://arxiv.org/abs/2402.04102 · HTML: https://mlsanity.com/paper/2402.04102/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 11 references that are in the map.
- First posted on arXiv 6 Feb 2024.

## Builds on (most cited first, 4 of 4)

- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Malware Detection by Eating a Whole EXE](https://mlsanity.com/paper/1710.09435/) (2017)
- [A Survey of Machine Learning Methods and Challenges for Windows Malware Classification](https://mlsanity.com/paper/2006.09271/) (2020)
- [AI-based Malware and Ransomware Detection Models](https://mlsanity.com/paper/2207.02108/) (2022)

## Built on by (most cited first, 1 of 1)

- [Semantic Preprocessing for LLM-based Malware Analysis](https://mlsanity.com/paper/2506.12113/) (2025)

## Abstract (arXiv)

Existing research on malware detection focuses almost exclusively on the detection rate. However, in some cases, it is also important to understand the results of our algorithm, or to obtain more information, such as where to investigate in the file for an analyst. In this aim, we propose a new model to analyze Portable Executable files. Our method consists in splitting the files in different sections, then transform each section into an image, in order to train convolutional neural networks to treat specifically each identified section. Then we use all these scores returned by CNNs to compute a final detection score, using models that enable us to improve our analysis of the importance of each section in the final score.