🧠 Malware Detection using Machine Learning

A machine learning-based approach to detect malicious executable files (malware) using static analysis features extracted from PE (Portable Executable) files.
This project leverages supervised learning algorithms to classify binaries as malware or legitimate software, helping enhance cybersecurity automation.

---

📊 About the Dataset

• The dataset contains approximately 138,047 samples in total.
• Includes 41,323 legitimate binary files (EXE/DLL) that are malware-free.
• Includes 96,724 malware samples collected from VirusShare.com.
• Each record contains 57 attributes representing file characteristics, with the final column legitimate serving as the label:
  • 1 → Legitimate (safe file)
  • 0 → Malware (infected file)

---

⚙️ Technologies Used

• Programming Language: Python 🐍
• Libraries:
  • pandas, NumPy – Data manipulation & analysis
  • scikit-learn – Machine learning modeling
  • matplotlib, seaborn – Data visualization
• Jupyter Notebook – Interactive analysis & model training environment

---

🧩 Project Workflow

1. Data Preprocessing

• Loaded the dataset from a CSV file using a vertical bar (|) separator.
• Cleaned and explored feature columns.
• Split the dataset into two parts:
  • Malware-free data
  • Malware-infected data
• Dropped the legitimate column to use as the output label.

2. Exploratory Data Analysis (EDA)

• Examined distributions of key features.
• Visualized correlations between attributes and target labels.
• Checked for missing values and data imbalance.

3. Feature Engineering

• Standardized/normalized numeric features.
• Selected the most important features using feature importance ranking.
• Visualized top features contributing to malware detection.

4. Model Training

• Split data into training and testing sets (e.g., 80/20).
• Trained multiple models including:
  • Random Forest Classifier
  • Decision Tree
  • Gradient Boosting
• Tuned hyperparameters for better performance.

5. Model Evaluation

• Evaluated models using:
  • Accuracy Score
  • Confusion Matrix
  • Precision, Recall, and F1-Score
• Compared performance between models and identified the best-performing one.

🧪 How to Run

1. Clone the repository:

git clone https://github.com/yourusername/malware-detection-ml.git

cd malware-detection-ml

2. Install required dependencies:

3. Open the notebook:

jupyter notebook Malware_Detection.ipynb 4. Run all cells to reproduce preprocessing, model training, and evaluation steps.

🎯 Goals and Outcomes

✅ Build an automated system to classify malware and legitimate files.

✅ Achieve high detection accuracy with minimal false positives.

✅ Gain insight into feature importance for malware behavior analysis.

📈 Results

Achieved strong classification accuracy across multiple models.

Random Forest performed best with high precision and recall.

Visualizations demonstrated clear separation between malware and clean binaries.

🔐 Key Insights

Static file attributes (e.g., entropy, import functions, section sizes) are highly discriminative for malware detection.

Ensemble models such as Random Forest outperform simpler algorithms due to their robustness against noise.

Feature selection improves both accuracy and training efficiency.

🧾 References

Dataset inspired by open malware repositories (e.g., VirusShare, Kaggle).

Feature engineering techniques adapted from research on PE file static analysis.

Built and tested in Python 3.x using Jupyter Notebook.