
01Invariant structural malware detection
PE-Anchor
250 msScan deadline
A CPU-only Windows PE malware-screening system that separates invariant structural screening from mutable full-file context analysis.
- Two independently trained models, a 73-feature structural Anchor model and a 2,568-feature full-context model, joined by an asymmetric decision policy.
- Three explicit outcomes, MALICIOUS_SCREEN, CLEAN_SCREEN and REVIEW, with fail-closed handling for uncertainty, malformed inputs, timeouts and resource limits.
- Order-statistic Neyman-Pearson calibration and transformation-contract testing to control benign false alarms and keep scores stable under permitted edits.
- A bounded scanner daemon with a 32 MiB input limit, a 250 ms scan deadline and zero waiting queue.
- Python
- Windows PE
- LightGBM
- Adversarial robustness

