The present paper describes a static model of malware detection and employs a tri-class prevention policy that operates on the EMBER 2024 Win64 partition. A LightGBM classifier trained on 1,040,000 samples and 804 static PE features achieves AUC-ROC = 0.9979, precision = 98.7%, recall = 97.4%, and F1 = 0.9805 on the temporally-split 240,000-sample test set. An innovative Tri-class Threshold Scheme (BLOCK/SUSPICIOUS/ALLOW) obtained by constrained F2-score optimisation on a separate validation set obtains 97.9% malware detection with 98.1% benign pass rate. Efficient model scoring is verified by mean per-sample model inference latency of 2.30 ms (P99: 2.70 ms) measured on pre-extracted EMBER features, future work is characterized by a complete end-to-end pipeline study, which includes feature extraction overhead. McNemar statistical testing is used to compare 5 classifiers across the same temporal splits. Empirical evidence of this is the retraining-based ablation of all nine EMBER v3 feature groups, which shows that none of the group removals leads to an AUC value below 0.996. The interpretability analysis via SHAP shows PE initialised-data section size, Authenticode certificate presence, and exception table structure as the most discriminating malware indicators.
