mihai-chindris/malware-detection-lgbm

Malware Detection LightGBM

LightGBM-based static malware detector for PE (Portable Executable) files. Classifies Windows executables as benign or malicious using structural PE header features.

Intended Use

• —Primary: Static analysis of PE files for malware classification
• —Secondary: Educational demonstration of ML-based malware detection
• —Not suitable for: Dynamic analysis, packed/obfuscated samples, or production-grade antivirus replacement

Training Data

• —Dataset: fabriciojoc/brazilian-malware-dataset
• —Features: Structural PE header fields (imports, sections, resources, etc.)
• —Split: 80/20 train/test with stratification

Training Procedure

• —Model: LightGBM (gradient boosting)
• —Preprocessing: Custom pipeline in preprocessing_pipeline.joblib
• —Hyperparameters: See model_metrics.json for full configuration

Performance (hold-out test set)

Artifacts

• —production_model.joblib - trained LightGBM model
• —preprocessing_pipeline.joblib - feature extraction pipeline
• —feature_names.json - feature name mapping
• —model_metrics.json - training metrics and configuration

Limitations

• —Trained on PE header features only; does not analyze code behavior
• —Performance may degrade on obfuscated or packed samples
• —Tested on Brazilian malware dataset; generalization to other regions unverified

Citation

If you use this model, please cite the original dataset:

@dataset{fabriciojoc2024brazilian-malware,
  author = {Fabricio, Joc},
  title = {Brazilian Malware Dataset},
  year = {2024},
  publisher = {Hugging Face},
  url = {https://huggingface.co/datasets/fabriciojoc/brazilian-malware-dataset}
}