elastic/ember resource

Health v2 · maintenance only

Flags: no_releases archived no_license

Adoption not part of the score

1169 stars · 314 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

EMBER is a benchmark dataset of features extracted from over 2 million PE (Portable Executable) files for training and evaluating malware classification models. The repository includes tooling to reproducibly extract features from PE files, train benchmark models, and classify new files.

Use cases

• train a malware classifier on PE file features
• benchmark machine learning models for malware detection
• extract static features from Windows executables
• research the evolution of PE file features over time
• classify new PE files with pretrained benchmark models
• build a dataset for security research on executables

When to choose

• you need a large labeled dataset of PE files for malware research
• you want reproducible feature extraction from executables
• you need a standard benchmark to compare malware detection models

When to avoid

• you need dynamic or behavioral malware analysis features
• you need real-time malware detection in production
• you work on macOS, where consistent feature extraction is not verified

Facets

dataset · maturity maintenance

machine-learning security data-science machine-learning security python windows malware-detection pe-files benchmark-dataset feature-extraction static-analysis security-research malware-analysis linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="elastic/ember")