miraO/malware-detection

Malware Detection API

A FastAPI-based REST API that analyzes Android APK files for malware using a hybrid of (1) a trained Random Forest classifier on the Drebin-215 static feature set and (2) a lightweight modern manifest-heuristic layer.

Why a hybrid?

The Random Forest is trained on the Drebin-215 dataset, whose feature vocabulary dates to ~2014. It does not contain modern Android permissions (e.g. REQUEST_INSTALL_PACKAGES, QUERY_ALL_PACKAGES), so modern droppers and trojans can stay invisible to the model alone. A small rule layer reads the manifest directly and flags well-known modern malware capability combinations (e.g. silent app installation + boot persistence + package reconnaissance = dropper/trojan). The final verdict is Infected if either the ML model or the heuristic layer flags the sample. These rules match on the actual requested permissions — not on file hashes — so they generalise to other samples with the same behaviour.

A sample is reported Clean only when both layers agree it is benign.

Endpoint

POST /predict

Upload an APK file as multipart/form-data with field name apk_file.

Example (curl)

curl -X POST "https://<your-space-url>/predict" \
     -F "apk_file=@YourApp.apk"

Response – Clean

{
  "status": "Clean",
  "filename": "YourApp.apk",
  "analysis": {
    "summary": "No malicious behavior detected.",
    "detected_indicators": [],
    "recommendation": "Safe to install based on static analysis."
  }
}

Response – Infected

{
  "status": "Infected",
  "filename": "YourApp.apk",
  "threat_type": "Trojan-Dropper",
  "risk_level": "Critical",
  "detection_source": "Heuristic (modern manifest analysis)",
  "analysis": {
    "summary": "...",
    "secondary_threats": [],
    "detected_indicators": ["..."],
    "recommendation": "CRITICAL: Do NOT install."
  }
}

Self-test

python selftest.py path/to/Clean.apk path/to/Infected.apk

Verifies the analyzer end-to-end on two reference samples (expects the first to be reported Clean and the second Infected).