surajr / machine-learning-approach-for-malware-detection

A Machine Learning approach for classifying a file as Malicious or Legitimate

Machine-Learning-approach-for-Malware-Detection

A Machine Learning approach for classifying a file as Malicious or Legitimate.

This approach tries out 6 different classification algorithms before deciding which one to use for prediction by comparing their results. Different Machine Learning models tried are, Linear Regression, RandomForest, DecisionTree, Adaboost, Gaussian, Gradient Boosting.

In order to test the model on an unseen file, it's required to extract the characteristics of the given file. Python's pefile.PE library is used to construct and build the feature vector and a ML model is used to predict the class for the given file based on the already trained model.

Dependencies

• pandas pip install pandas
• numpy pip install numpy
• pickle pip install pickle
• scipy pip install scipy
• scikit pip install -U scikit-learn

machine-learning-approach-for-malware-detection's Issues

False Positive Rate

FPR should be the fraction of false positive divided by the number of non malicious files. Therefore it should be mt[0][1] / float (sum (mt[1]) * 100)

Correct me if I am wrong?

malware_test.py file not found

ERROR:root:File 'malware_test.py' not found.

FileNotFoundError: [WinError 2] The system cannot find the file specified: '-f'

Obtaining incorrect results on changing the train test split ratio

If the test ratio is changed to 0.3, it shows all the files as benign, if changed to 0.2, it shows all to be malicious. Can you please suggest to improve the same?? I am selecting the following features using extratrees classifier with n_estimator value = 100

['DllCharacteristics', 'Machine', 'Characteristics', 'SectionsMaxEntropy', 'VersionInformationSize', 'ImageBase', 'Subsystem', 'MajorSubsystemVersion', 'ResourcesMinEntropy', 'SizeOfOptionalHeader', 'ResourcesMaxEntropy', 'MajorOperatingSystemVersion', 'SectionsMinEntropy', 'SectionsMeanEntropy']

Error in detection

Error in detection

Error in detection

When I run your code it shows wrong result. I have tested with skype.exe it shows as malicious but actually skype is not malicious. Kindly upload the correct code.

malware_test.py not running properly

it says:

FileNotFoundError Traceback (most recent call last)
in ()
185 clf = joblib.load('classifier/classifier.pkl')
186 features = pickle.loads(open(os.path.join('classifier/features.pkl'),'rb').read())
--> 187 data = extract_infos(sys.argv[1])
188 pe_features = map(lambda x:data[x], features)
189

malware_test.py file not found

is there any paper?

Hi Dear,
is there any paper for this project .. thanks in advance.