cyberhunters/malware-detection-using-machine-learning

Multi-class malware classification using Deep Learning

Malware Detection Using Machine Learning

This repository contains the source code for detecting different type of malwares using Deep learning based Feature Extraction and Wraper based Feature Selection Technique. A research paper describing how it works is availible at "https://arxiv.org/abs/1910.10958"

Two major approaches we used for malware classification: 1- Image representation of byte file Independent of the platform It requires No knowledge of domain like assembly instructions 2- Hybrid feature space using both ASM and byte file This approach is platform dependent but gives a better performance that using byte file. Requires huge resources and processing time.

The data used in these tutorial can be found on the Hybrid(Final) folder of following drive link:

https://drive.google.com/drive/folders/1s7EC4s_-hP9q5vEhs-3vAubspcZbBADK?usp=sharing

After downloading the required dataset, following is the sequence of files in the hybrid folder whose execution will lead to results.

1. "Creating hybrid dataset"

2. "Min-max normalization(hybrid dataset)"

3. "ANN-Results"

The project was done under the guidance of Dr. Asifullah Khan, DCIS, PIEAS.

malware-detection-using-machine-learning's Issues

How to generate CSV Files?

I am trying to recreate this project so I can use my own Malicious and Benign files to build the CSV files but there is no explanation or code within the project to get the data for data_to_test.csv, data_to_tra.csv, data_to_val.csv. Is it possible to know how this data was extracted or if you would be so kind to include it to the repo. Thank you for any insight

How to make predictions on files

First of all thank you very much for supplying all this as its very difficult to follow the documentation on the kaggle challenge. I have the n_final_hybrid_valid.csv and optimize folder with checkpoints. Im using windows 10 x64 and python3.6 and the folders it creates wont open saying there corrupted or damaged. I have also tried saving them as rar files but same thing happens. My main question here is what data must I pass to the ann_hybrid to make a prediction on a unknown file? is that the proper way to use this or does a prediction module need to be written?. Would i need to write something that will take the file path as a input then disassemble it and extract the byte code and normalize the data from that file to match the output in the CSV? please help and thank you for your time.

I hope to hear from you soon!
GREAT WORK!!