mihai-chindris/malware-detection-lgbm

Malware Detection LightGBM

LightGBM-based static malware detector for PE (Portable Executable) files. Classifies Windows executables as benign or malicious using structural PE header features.

Intended Use

• Primary: Static analysis of PE files for malware classification
• Secondary: Educational demonstration of ML-based malware detection
• Not suitable for: Dynamic analysis, packed/obfuscated samples, or production-grade antivirus replacement

Training Data

• Dataset: fabriciojoc/brazilian-malware-dataset
• Features: Structural PE header fields (imports, sections, resources, etc.)
• Split: 80/20 train/test with stratification

Training Procedure

• Model: LightGBM (gradient boosting)
• Preprocessing: Custom pipeline in preprocessing_pipeline.joblib
• Hyperparameters: See model_metrics.json for full configuration

Performance (hold-out test set)

Metric	Value
AUC	0.9978
Accuracy	0.9895
Confusion Matrix	[[4158, 66], [39, 5774]]

Artifacts

• production_model.joblib - trained LightGBM model
• preprocessing_pipeline.joblib - feature extraction pipeline
• feature_names.json - feature name mapping
• model_metrics.json - training metrics and configuration

Limitations

• Trained on PE header features only; does not analyze code behavior
• Performance may degrade on obfuscated or packed samples
• Tested on Brazilian malware dataset; generalization to other regions unverified

Citation

If you use this model, please cite the original dataset:

@dataset{fabriciojoc2024brazilian-malware,
  author = {Fabricio, Joc},
  title = {Brazilian Malware Dataset},
  year = {2024},
  publisher = {Hugging Face},
  url = {https://huggingface.co/datasets/fabriciojoc/brazilian-malware-dataset}
}