Back to Projects
AI-Malware-Classifier-V1
A machine learning malware classifier analyzing static PE features, signatures, and behavioral logs using Random Forest.
cybersecuritymachine-learningmalware-analysispefilepythonrandom-foreststatic-analysis
0
Stars
0
Forks
0
Watchers
0
Open Issues
README.md
# AI Malware Classifier V1
A machine learning-based malware classification tool that analyzes static properties (PE headers, imports, sections, test signatures) and dynamic behavioral logs to detect malicious Windows files. Built entirely on free, open-source Python libraries.
---
## 📸 Dashboard Preview
<div align="center">
<img src="screenshots/screenshot1.png" width="45%" alt="Terminal Training Output" />
<img src="screenshots/screenshot2.png" width="45%" alt="Classification Results" /></div>
---
## ✨ Features
* **Static Feature Extraction:** Uses `pefile` to parse executable headers, import counts, section anomalies, and test signatures.
* **Behavioral Log Parsing:** Ingests JSON-formatted runtime telemetry (e.g., registry modifications, network connections).
* **Machine Learning Engine:** Uses Scikit-Learn's Random Forest classifier for high-accuracy threat classification.
* **Interactive CLI:** Interactive scanning loop with path normalization for drag-and-drop operations.
---
## 📂 Folder Structure
```text
AI-Malware-Classifier-V1/
├── .github/
│ └── release.yml
├── data/
│ ├── default_behavior.json
│ └── training_set.csv
├── models/
│ └── rf_classifier.model
├── screenshots/
│ ├── screenshot1.png
│ └── screenshot2.png
├── src/
│ ├── __init__.py
│ ├── classifier.py
│ ├── feature_extractor.py
│ └── model_trainer.py
├── .gitignore
├── ABOUT.md
├── LICENSE
├── main.py
├── README.md
├── RELEASE_NOTES.md
└── requirements.txt
```
---
## 🚀 Getting Started & Installation
### Prerequisites
* Python 3.10 or higher (Tested on Python 3.13 and Python 3.14 on Windows 10)
* Git
### 1. Clone the Repository
```bash
git clone https://github.com/JuttSahib1999/AI-Malware-Classifier-V1.git
cd AI-Malware-Classifier-V1
```
### 2. Set Up Virtual Environment
On Windows (Command Prompt / PowerShell):
```dos
python -m venv venv
# (Or use 'py -3.13 -m venv venv' depending on your preference)
.\venv\Scripts\activate
```
### 3. Install Dependencies
```dos
pip install -r requirements.txt
```
---
## 💻 How to Run the Program
1. **Launch the Scanner:**
```dos
python main.py
```
On startup, the system verifies the training dataset, trains the Random Forest model if not already present, and launches the interactive scanner.
2. **Scan a Target File:**
Enter the full path of any binary or drag-and-drop the file directly into the terminal window:
```text
Enter file path to scan (or type 'exit' to quit): C:\Windows\System32\notepad.exe
```
3. **Attach Dynamic Behavior Logs (Optional):**
If you have sandbox JSON telemetry, provide its path. Otherwise, press ENTER to proceed with static structural analysis:
```text
Enter behavior log JSON path (press ENTER to skip):
```
4. **Review Output:**
The program outputs the classification verdict (Benign vs. Malicious) along with the exact extracted structural feature counts.
---
## 🧪 Testing Examples
* **Legitimate Windows Binaries (Expected: Benign):**
* `C:\Windows\System32\notepad.exe`
* `C:\Windows\System32\calc.exe`
* `C:\Windows\System32\cmd.exe`
* **Antivirus Test Signatures (Expected: Malicious):**
* Standard `eicar.com` test file
---
## 👨💻 Author
Created by **Abdul Muqeet Tabraiz**
* **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* **GitHub:** [JuttSahib1999](https://github.com/JuttSahib1999)
---
## 📄 License
Distributed under the MIT License. See `LICENSE` for more information.