Malware Classification Project

A comprehensive machine learning project for malware detection and classification using advanced ensemble methods and gradient boosting algorithms. This project achieves 99.42% accuracy with state-of-the-art models like LightGBM and XGBoost.

🚀 Project Overview

This project implements a robust malware classification system that analyzes Portable Executable (PE) files to distinguish between malware and benign software. Using a dataset of 5,184 samples with 70 engineered features, the system employs 13 different machine learning algorithms to achieve exceptional detection accuracy.

📊 Key Results

Model	Accuracy	ROC-AUC	F1 Score	Training Time
LGBMClassifier	99.42%	0.9944	0.9945	0.38s
XGBClassifier	99.42%	0.9943	0.9945	0.14s
CatBoostClassifier	99.33%	0.9932	0.9936	1.49s
HistGradientBoostingClassifier	99.33%	0.9934	0.9936	0.70s
RandomForest	99.23%	0.9923	0.9927	0.49s

🛠️ Technology Stack

Core Libraries

• Data Processing: pandas, numpy
• Machine Learning: scikit-learn
• Gradient Boosting: XGBoost, LightGBM, CatBoost
• Visualization: matplotlib, seaborn
• Advanced Analytics: UMAP, LIME
• Model Evaluation: Cross-validation, ROC-AUC, Cohen-Kappa

Models Implemented

• Support Vector Machine (SVM)
• Logistic Regression
• K-Nearest Neighbors
• Decision Tree
• Random Forest
• XGBoost Classifier
• AdaBoost Classifier
• Gradient Boosting Classifier
• Histogram Gradient Boosting
• LightGBM Classifier
• CatBoost Classifier
• Multi-layer Perceptron (MLP)
• Linear Discriminant Analysis

📁 Dataset Features

The dataset contains 70 engineered features extracted from PE files:

Feature Categories:

• PE File Headers: e_cblp, e_cp, e_cparhdr, e_maxalloc, e_sp, e_lfanew
• File Characteristics: NumberOfSections, CreationYear, filesize
• Entropy Measures: E_text, E_data, E_file (measuring randomness/encryption)
• Section Analysis: sus_sections, non_sus_sections (suspicious section detection)
• Packer Information: packer, packer_type (compression/obfuscation detection)
• File Properties: fileinfo (additional metadata)

🔬 Methodology

1. Data Preprocessing

• Label encoding for categorical variables
• Standard scaling for numerical features
• Feature engineering and selection

2. Model Training & Evaluation

• Cross-Validation: K-fold validation for robust performance estimation
• Comprehensive Metrics: Accuracy, Precision, Recall, F1-Score, ROC-AUC, Cohen-Kappa
• Performance Monitoring: Training time, prediction time, memory usage
• Statistical Analysis: Standard deviation across folds for stability assessment

3. Model Comparison

• Systematic evaluation of 13 different algorithms
• Performance ranking based on multiple metrics
• Efficiency analysis (speed vs. accuracy trade-offs)

📈 Performance Analysis

Top Performing Models:

1. LightGBM: Best overall performance with 99.42% accuracy and fastest prediction time
2. XGBoost: Tied for best accuracy with superior training speed (0.14s)
3. CatBoost: Excellent stability with lowest standard deviation (0.33%)

Key Insights:

• Gradient Boosting methods significantly outperform traditional algorithms
• Ensemble methods (Random Forest, Boosting) show superior generalization
• Tree-based models excel at capturing non-linear patterns in PE file features
• Memory efficiency varies significantly across models (69KB to 12MB)

🚦 Getting Started

Prerequisites

pip install catboost xgboost lightgbm umap-learn lime
pip install pandas numpy scikit-learn matplotlib seaborn

Installation

1. Clone the repository
2. Install required dependencies
3. Place your dataset as Raw.csv in the project directory
4. Run the Jupyter notebook main_V2.ipynb

Usage

# Load and preprocess data
df = pd.read_csv('Raw.csv')

# Train models (example with LightGBM)
from lightgbm import LGBMClassifier
model = LGBMClassifier()
model.fit(X_train, y_train)

# Evaluate performance
accuracy = model.score(X_test, y_test)

📊 Evaluation Metrics

The project employs comprehensive evaluation metrics:

• Accuracy: Overall classification correctness
• ROC-AUC: Area under the ROC curve for binary classification
• Precision: True positive rate (malware correctly identified)
• Recall: Sensitivity (malware detection rate)
• F1-Score: Harmonic mean of precision and recall
• Cohen-Kappa: Agreement measure accounting for chance
• Cross-Validation: K-fold validation for robust performance estimation

🔍 Feature Importance & Interpretability

• LIME Integration: Local interpretable model-agnostic explanations
• Feature Analysis: Understanding which PE file characteristics drive predictions
• UMAP Visualization: Dimensionality reduction for data exploration

🎯 Applications

• Cybersecurity: Real-time malware detection systems
• Antivirus Software: Integration with security solutions
• Threat Intelligence: Large-scale malware analysis
• Research: Academic studies in machine learning and cybersecurity

📋 Future Enhancements

• Deep Learning: Neural network architectures for complex pattern recognition
• Real-time Processing: Stream processing for live malware detection
• Feature Engineering: Additional PE file characteristics
• Adversarial Robustness: Defense against evasion attacks
• Model Deployment: Production-ready API endpoints

🤝 Contributing

Contributions are welcome! Please feel free to submit pull requests, report bugs, or suggest features.

📄 License

This project is open-source and available under the MIT License.

👨‍💻 Author

Amitabh Thakur

• Computer Science (AI & ML) Student
• B.Tech at Dayananda Sagar University
• Founder & Managing Director, Humans Care Foundation
• Location: Bengaluru, Karnataka, India

---

Built with passion for cybersecurity and machine learning excellence.