ml-malware-detection/pe-malware-classification
This project explores the application of supervised machine learning techniques for detecting malware based on Portable Executable (PE) file features.
The objective is to demonstrate how static PE features can be leveraged to classify executable files as malicious or benign, and to discuss the feasibility, limitations, and real-world applicability of such models in cybersecurity systems.
Traditional signature-based malware detection struggles against unknown and obfuscated threats. This project investigates whether supervised learning models can identify malicious patterns from PE file structures without relying on signatures.
- Extracted static features from Windows PE files using Python
- Selected structural features including:
- Number of sections
- Entry point address
- Image size
- Code and data base addresses
- Trained a Random Forest classifier to distinguish malware from benign files
- Evaluated performance using accuracy, precision, recall, and F1-score
- Algorithm: Random Forest Classifier
- Dataset: Small-scale labeled PE samples (malware vs normal)
- Metrics:
- Accuracy
- Precision
- Recall
- F1-score
⚠️ Results show high accuracy on a limited dataset. The project explicitly discusses overfitting risks and the need for larger, more diverse datasets.
- Static analysis limitations against packed or encrypted malware
- Risks of overfitting due to small sample size
- Importance of explainability and auditability in ML-based security tools
- Potential integration with endpoint protection and threat intelligence systems
The full technical and analytical report is available here:
📄 report/malware_detection_report.pdf
- Malware analysis fundamentals
- PE file structure analysis
- Supervised machine learning
- Security risk evaluation
- Technical documentation and reporting
This project was conducted for educational purposes. No live malware is included in this repository.