README.md

metadata

language:
  - en
library_name: sklearn
tags:
  - malware-detection
  - tabular-classification
  - lightgbm
  - scikit-learn
pipeline_tag: tabular-classification
license: mit
metrics:
  - roc_auc
  - accuracy
datasets:
  - fabriciojoc/brazilian-malware-dataset
model-index:
  - name: malware-detection-lgbm
    results:
      - task:
          type: tabular-classification
          name: Malware Detection
        dataset:
          name: Brazilian Malware Dataset (hold-out test set)
          type: tabular
        metrics:
          - type: roc_auc
            value: 0.9978
            name: AUC
          - type: accuracy
            value: 0.9895
            name: Accuracy

Malware Detection LightGBM

LightGBM-based static malware detector for PE (Portable Executable) files. Classifies Windows executables as benign or malicious using structural PE header features.

Intended Use

• Primary: Static analysis of PE files for malware classification
• Secondary: Educational demonstration of ML-based malware detection
• Not suitable for: Dynamic analysis, packed/obfuscated samples, or production-grade antivirus replacement

Training Data

• Dataset: fabriciojoc/brazilian-malware-dataset
• Features: Structural PE header fields (imports, sections, resources, etc.)
• Split: 80/20 train/test with stratification

Training Procedure

• Model: LightGBM (gradient boosting)
• Preprocessing: Custom pipeline in preprocessing_pipeline.joblib
• Hyperparameters: See model_metrics.json for full configuration

Performance (hold-out test set)

Metric	Value
AUC	0.9978
Accuracy	0.9895
Confusion Matrix	[[4158, 66], [39, 5774]]

Artifacts

• production_model.joblib - trained LightGBM model
• preprocessing_pipeline.joblib - feature extraction pipeline
• feature_names.json - feature name mapping
• model_metrics.json - training metrics and configuration

Limitations

• Trained on PE header features only; does not analyze code behavior
• Performance may degrade on obfuscated or packed samples
• Tested on Brazilian malware dataset; generalization to other regions unverified

Citation

If you use this model, please cite the original dataset:

@dataset{fabriciojoc2024brazilian-malware,
  author = {Fabricio, Joc},
  title = {Brazilian Malware Dataset},
  year = {2024},
  publisher = {Hugging Face},
  url = {https://huggingface.co/datasets/fabriciojoc/brazilian-malware-dataset}
}