katerynach/malware-classification-with-ml

Bachelor Thesis for XAMK - Machine Learning Methods for Malware Detection and Classification

Machine Learning Methods for Malware Detection and Classification

This project is my final work for the Bachelor of Engineering degree in South-Eastern Finland University of APplied Sciences. The idea was to build the machine learning based classification of malware on top of the Cuckoo Sandbox, test how it can detect unknown malware (to simulate polymorphic or zero-day behavior) and evaluate the accuracy compared to the current signature-based methods.

Specifically, k-Nearest-Neighbors, Decision Trees, Support Vector Machines, Naive Bayes and Random Forest classifiers were evaluated. The dataset used for this study consistsed of the 1156 malware files of 9 families of different types and 984 benign files of various formats. The familes included Dridex, Locky, CTB-Locker, TeslaCrypt, Vawtrak, Zeus, Darkcomet, Cybergate, Xtreme.

If you find the work useful, kindly cite is as:

@article{chumachenko2017machine,
  title={Machine learning methods for malware detection and classification},
  author={Chumachenko, Kateryna and others},
  year={2017},
  publisher={Kaakkois-Suomen ammattikorkeakoulu}
}

UPD

The amount of requests to share the data used for analysis has been high, but unfortunately it is not possible for me to do this at this point due to restrictions related to its sensitivity.

malware-classification-with-ml's Issues

Return value same as return code?

I was going through your report and your extract_data_with_scores.py. In your report you have mentioned return codes while in your code you are fetching return value from cuckoo json report.So just to clarify, are return codes equal to return value? And is it right that return codes are represented by 32 bit hex decimal?
Thanks

Malware samples

The article is wonderful. I would like to ask you about the malware samples used in the article. Can you share with me? I am currently developing a project similar to yours and still lack a lot of data. Hope you can help me.

malware dataset