Lightweight Vulnerability-Aware Malware Triage: Operational Value and Generalization Under Family and Temporal Shift

Security operations require effective prioritization of malware samples that warrant deeper investigation. This study evaluates whether five Portable Executable (PE) metadata features—Packed, Entropy, Packer, Compiler, and Linker—can support lightweight vulnerability-aware triage using PEVuln. After hash-based deduplication, 35,800 unique samples remained, including 559 vulnerability-associated samples. Leakage-safe pipelines evaluated a prior baseline, logistic regression, Random Forest, Extra Trees, and LightGBM under random, family-disjoint, and chronological holdout protocols. Hyperparameters were selected by five-fold cross-validation using Average Precision (AP), thresholds on separate validation data using F2, and uncertainty by 1000 stratified-bootstrap repetitions. Under random evaluation, tree ensembles achieved AP of 0.253–0.255, about 16 times prevalence, while a 5% Random Forest review budget recovered 50% of positives. The highest test AP fell to 0.118 under family-disjoint evaluation and 0.015 chronologically. Feature analyses showed strong complementarity: Entropy alone achieved AP 0.0212, yet removing it reduced full-model AP from 0.2553 to 0.1695. A matched cohort comparison demonstrated superior predictive performance for EMBER, while the five-feature representation retained useful ranking capability at a 5% review budget under both random and family-disjoint evaluation. This representation provides useful first-stage ranking signal but limited robustness under family and chronological shift.