TITLE: Knowledge-Based Dataset for Training PE Malware Detection Models 

ABSTRACT: Ontologies are a standard for semantic schemata in many knowledge-intensive
domains of human interest. They are now becoming increasingly important also in
areas until very recently dominated by subsymbolic representations and
machine-learning-based data processing. One such area is information security,
and more specifically malware detection. We propose PE Malware Ontology that
offers a reusable semantic schema for Portable Executable (PE, Windows binary
format) malware files. The ontology was inspired by the structure of the data
in the EMBER dataset and it currently covers the data intended for static
malware analysis. With this proposal, we hope to achieve: a) a unified semantic
representation for PE malware datasets that are available or will be published
in the future; (b) applicability of symbolic, neural-symbolic, or otherwise
explainable approaches in the PE Malware domain that may lead to improved
interpretability of results which may now be characterized by the terms defined
in the ontology; and (c)by joint publishing of semantically treated EMBER data,
including fractional datasets, also improved reproducibility of experiments.
Ontologies are a standard for semantic schemata in many knowledge-intensive
domains of human interest. They are now becoming increasingly important also in
areas until very recently dominated by subsymbolic representations and
machine-learning-based data processing. One such area is information security,
and more specifically malware detection. We propose PE Malware Ontology that
offers a reusable semantic schema for Portable Executable (PE, Windows binary
format) malware files. The ontology was inspired by the structure of the data
in the EMBER dataset and it currently covers the data intended for static
malware analysis. With this proposal, we hope to achieve: a) a unified semantic
representation for PE malware datasets that are available or will be published
in the future; (b) applicability of symbolic, neural-symbolic, or otherwise
explainable approaches in the PE Malware domain that may lead to improved
interpretability of results which may now be characterized by the terms defined
in the ontology; and (c)by joint publishing of semantically treated EMBER data,
including fractional datasets, also improved reproducibility of experiments.
Knowledge-Based Dataset for Training PE Malware Detection Models
http://arxiv.org/abs/2301.00153v1