aunk/ransomshield-pe-malware

RansomShield — PE Malware Detection via Hybrid Denoising Autoencoder

A multi-task deep-learning system trained on 43,171 Windows PE files that fuses reconstruction-based anomaly scoring with supervised classification. The noise-injected encoder learns robust feature representations and a sigmoid head flags malware with high precision and recall.

Prepared by: Ali Naeem Kareem · Supervisor: Prof. Iman Saleh

What's inside

• —Landing page — hero, project info, tech stack
• —Dashboard — live counts and metrics from the latest training run
• —Dataset Explorer — class distribution, feature distributions, correlation heatmap, RF + XGBoost importance plots
• —Model Training — configurable hybrid denoising autoencoder or supervised autoencoder, with live per-epoch log streaming
• —Results — full metrics, confusion matrix, hyperparameters per run
• —Compare All — grouped bar chart + table comparing every saved run
• —History — two-pane list/detail view of every persisted experiment

Stack

Python · Flask · TensorFlow / Keras · scikit-learn · XGBoost · Plotly.js · SQLite

Run locally

pip install -r requirements.txt
python src/app.py
# open http://localhost:5000

Notes for the Space

• —The free-tier CPU is shared and slow; the first request after idle takes ~30–60s to boot.
• —Training runs in-browser will be slow on free tier — use the prepopulated experiments.db for the demo.
• —experiments.db resets when the Space restarts (free tier has ephemeral storage).