Existing research on malware detection focuses almost exclusively on the
detection rate. However, in some cases, it is also important to understand the
results of our algorithm, or to obtain more information, such as where to
investigate in the file for an analyst. In this aim, we propose a new model to
analyze Portable Executable files. Our method consists in splitting the files
in different sections, then transform each section into an image, in order to
train convolutional neural networks to treat specifically each identified
section. Then we use all these scores returned by CNNs to compute a final
detection score, using models that enable us to improve our analysis of the
importance of each section in the final score.

现有的恶意软件检测研究主要关注检测速度，但在某些情况下，了解算法的结果或获取更多信息，例如在文件中进行分析的位置，也是很重要的。为了达到这个目标，我们提出了一个新的模型来分析可移植可执行文件。我们的方法是将文件分成不同的部分，然后将每个部分转化为图像，以便训练卷积神经网络以针对性地处理每个已识别的部分。然后，我们使用 CNN 返回的所有这些分数来计算最终的检测分数，利用模型来改善对最终分数中每个部分的重要性的分析。