EMC: A Semantic-Enhanced Malware Classification Method with Robustness and Scalability

Driven by substantial financial incentives, Portable Executable (PE) malware continues to evolve, posing persistent and growing threats. Malware classification has long been a vital research area, and numerous classification approaches have been proposed. However, existing methods still face performance limitations and often lack robustness when dealing with complex analytical scenarios that involve concept drift. In this paper, we propose a robust and scalable PE malware classification framework based on program semantic analysis and feature enhancement, and implement a prototype system named EMC. Our approach focuses on behavior-oriented semantic understanding of programs, constructing a more effective feature space while eliminating spurious correlations between features at a fine-grained level to enhance robustness. EMC extracts comprehensive behavior-oriented binary opcode sequences and employs an encoder sliding window mechanism for semantic understanding and feature space construction. Furthermore, it combines random Fourier features and weighted resampling techniques to remove dependencies between features, and leverages mutual information to purify features. These enhancements enable the classification model to more accurately capture the intrinsic characteristics of malicious programs, thereby improving both accuracy and robustness. Compared with ten mainstream malware classification methods, EMC improves F1 scores by up to 12.06% under normal scenarios and by 6.64%–50.35% in scenarios involving concept drift.