---
language:
- en
library_name: sklearn
tags:
- malware-detection
- tabular-classification
- lightgbm
- scikit-learn
pipeline_tag: tabular-classification
license: mit
metrics:
- roc_auc
- accuracy
datasets:
- fabriciojoc/brazilian-malware-dataset
model-index:
- name: malware-detection-lgbm
  results:
  - task:
      type: tabular-classification
      name: Malware Detection
    dataset:
      name: Brazilian Malware Dataset (hold-out test set)
      type: tabular
    metrics:
    - type: roc_auc
      value: 0.9978
      name: AUC
    - type: accuracy
      value: 0.9895
      name: Accuracy
---

# Malware Detection LightGBM

LightGBM-based static malware detector for PE (Portable Executable) files. Classifies Windows executables as benign or malicious using structural PE header features.

## Intended Use

- **Primary**: Static analysis of PE files for malware classification
- **Secondary**: Educational demonstration of ML-based malware detection
- **Not suitable for**: Dynamic analysis, packed/obfuscated samples, or production-grade antivirus replacement

## Training Data

- **Dataset**: [fabriciojoc/brazilian-malware-dataset](https://huggingface.co/datasets/fabriciojoc/brazilian-malware-dataset)
- **Features**: Structural PE header fields (imports, sections, resources, etc.)
- **Split**: 80/20 train/test with stratification

## Training Procedure

- **Model**: LightGBM (gradient boosting)
- **Preprocessing**: Custom pipeline in `preprocessing_pipeline.joblib`
- **Hyperparameters**: See `model_metrics.json` for full configuration

## Performance (hold-out test set)

| Metric | Value |
|--------|-------|
| AUC | 0.9978 |
| Accuracy | 0.9895 |
| Confusion Matrix | [[4158, 66], [39, 5774]] |

## Artifacts

- `production_model.joblib` - trained LightGBM model
- `preprocessing_pipeline.joblib` - feature extraction pipeline
- `feature_names.json` - feature name mapping
- `model_metrics.json` - training metrics and configuration

## Limitations

- Trained on PE header features only; does not analyze code behavior
- Performance may degrade on obfuscated or packed samples
- Tested on Brazilian malware dataset; generalization to other regions unverified

## Citation

If you use this model, please cite the original dataset:

```bibtex
@dataset{fabriciojoc2024brazilian-malware,
  author = {Fabricio, Joc},
  title = {Brazilian Malware Dataset},
  year = {2024},
  publisher = {Hugging Face},
  url = {https://huggingface.co/datasets/fabriciojoc/brazilian-malware-dataset}
}
```