PRISM: A 2D Section-Aware Dataset That Rethinks Static PE Malware Detection

arXiv 2606.27109·medium signal

Existing static malware benchmarks like EMBER, BODMAS, and SOREL-20M represent each Windows PE file as a flat 1D feature vector, discarding section ordering and relational context. PRISM instead encodes every binary as a 2D matrix whose rows are PE sections in file order, plus a global summary row, preserving cross-section relationships. It's an open dataset and feature representation that could improve learning-based malware classifiers.