Upload folder using huggingface_hub

README.md

@@ -0,0 +1,129 @@
+---
+license: mit
+tags:
+  - tabular-classification
+  - malware-detection
+  - lightgbm
+  - cybersecurity
+  - pe-analysis
+  - sklearn
+datasets:
+  - custom
+metrics:
+  - accuracy
+  - roc_auc
+model-index:
+  - name: malware-detection-lgbm
+    results:
+      - task:
+          type: tabular-classification
+          name: Binary Malware Classification
+        metrics:
+          - name: AUC
+            type: roc_auc
+            value: 0.9978
+          - name: Accuracy
+            type: accuracy
+            value: 0.9895
+library_name: sklearn
+pipeline_tag: tabular-classification
+---
+
+# Malware Detection — LightGBM (Static PE Features)
+
+A LightGBM binary classifier for detecting malware from static Portable Executable (PE) header attributes. Trained on the Brazilian Malware Dataset (~50,000 samples) and optimized with Optuna Bayesian hyperparameter search.
+
+## Model Details
+
+| Property | Value |
+|----------|-------|
+| **Algorithm** | LightGBM (Gradient Boosted Decision Trees) |
+| **Estimators** | 200 trees |
+| **Hyperparameter Tuning** | Optuna (Bayesian Optimization) |
+| **Input Features** | 22 numeric PE header attributes |
+| **Output** | Binary probability — `0` = goodware, `1` = malware |
+| **Serialization** | joblib (scikit-learn compatible) |
+| **Training Framework** | LightGBM 4.6.0, scikit-learn 1.6.1 |
+| **Python Version** | 3.12 |
+
+## Performance
+
+### 10-Fold Stratified Cross-Validation (Training Set)
+
+| Model | AUC (mean ± std) | Accuracy (mean ± std) |
+|-------|------------------|-----------------------|
+| **LightGBM** | **0.9982 ± 0.0004** | **0.9869 ± 0.0015** |
+| XGBoost | 0.9979 ± 0.0005 | 0.9856 ± 0.0021 |
+| Random Forest | 0.9979 ± 0.0008 | 0.9882 ± 0.0017 |
+| CatBoost | 0.9965 ± 0.0006 | 0.9809 ± 0.0023 |
+| PyTorch MLP | 0.9872 ± 0.0018 | 0.9503 ± 0.0062 |
+| Decision Tree | 0.9800 ± 0.0019 | 0.9807 ± 0.0017 |
+| SVM (RBF) | 0.9685 ± 0.0027 | 0.9282 ± 0.0054 |
+| Logistic Regression | 0.8772 ± 0.0056 | 0.8136 ± 0.0052 |
+
+### Hold-Out Test Set (20%)
+
+| Metric | Value |
+|--------|-------|
+| AUC | 0.9978 |
+| Accuracy | 0.9895 |
+
+**Confusion Matrix:** `[[4146, 78], [45, 5768]]`
+
+- False Positives: 78 (goodware flagged as malware)
+- False Negatives: 45 (malware missed)
+
+## Input Features (22)
+
+`BaseOfCode`, `BaseOfData`, `Characteristics`, `DllCharacteristics`, `Entropy`, `FileAlignment`, `ImageBase`, `Machine`, `Magic`, `NumberOfRvaAndSizes`, `NumberOfSections`, `NumberOfSymbols`, `PE_TYPE`, `PointerToSymbolTable`, `Size`, `SizeOfCode`, `SizeOfHeaders`, `SizeOfImage`, `SizeOfInitializedData`, `SizeOfOptionalHeader`, `SizeOfUninitializedData`, `TimeDateStamp`
+
+## Files
+
+| File | Description |
+|------|-------------|
+| `production_model.joblib` | Trained LightGBM model (Optuna-optimized) |
+| `preprocessing_pipeline.joblib` | scikit-learn Pipeline: median imputation + standard scaling |
+| `feature_names.json` | Ordered list of 22 input feature names |
+
+## Usage
+
+```python
+import joblib
+import json
+import numpy as np
+
+# Load artifacts
+model = joblib.load("production_model.joblib")
+pipeline = joblib.load("preprocessing_pipeline.joblib")
+with open("feature_names.json") as f:
+    feature_names = json.load(f)
+
+# Prepare input (22 features in the correct order)
+sample = np.array([[...]])  # shape: (1, 22)
+transformed = pipeline.transform(sample)
+probability = model.predict_proba(transformed)[0][1]
+label = "MALWARE" if probability >= 0.5 else "GOODWARE"
+print(f"{label} (confidence: {probability:.4f})")
+```
+
+## Preprocessing Pipeline
+
+1. **Median imputation** — fitted on training data only (leakage-safe)
+2. **Standard scaling** — fitted on training data only
+3. Non-numeric columns dropped
+
+The pipeline is exported as a single `preprocessing_pipeline.joblib` and must be applied before inference.
+
+## Dataset
+
+**Brazilian Malware Dataset** (~50,000 PE samples, 27 raw features, binary target)
+
+> Ceschin, F., Pinage, F., Castilho, M., Menotti, D., Oliveira, L.S., and Gregio, A. "The Need for Speed: An Analysis of Brazilian Malware Classifiers." *IEEE Security & Privacy*, 16(6), 31–41, 2018. doi: [10.1109/MSEC.2018.2875369](https://doi.org/10.1109/MSEC.2018.2875369)
+
+## Source Code
+
+Full training pipeline, Flask web app, and CI/CD: [github.com/chindris-mihai-alexandru/malware-detection-ml](https://github.com/chindris-mihai-alexandru/malware-detection-ml)
+
+## License
+
+MIT

feature_names.json

@@ -0,0 +1,24 @@
+[
+  "BaseOfCode",
+  "BaseOfData",
+  "Characteristics",
+  "DllCharacteristics",
+  "Entropy",
+  "FileAlignment",
+  "ImageBase",
+  "Machine",
+  "Magic",
+  "NumberOfRvaAndSizes",
+  "NumberOfSections",
+  "NumberOfSymbols",
+  "PE_TYPE",
+  "PointerToSymbolTable",
+  "Size",
+  "SizeOfCode",
+  "SizeOfHeaders",
+  "SizeOfImage",
+  "SizeOfInitializedData",
+  "SizeOfOptionalHeader",
+  "SizeOfUninitializedData",
+  "TimeDateStamp"
+]

preprocessing_pipeline.joblib

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f4c7eac20f462d59d516083a1063fcf8eb77f33c8a085ef7c57230fdb6989604
+size 2417

production_model.joblib

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:99d7c6b8961a86a3537abe9f29b405ecb4b45e67a87afb9cef0d98ecde4bbaa0
+size 2284004