Malware Detection LightGBM

Intended Use

• Primary: Static analysis of PE files for malware classification
• Secondary: Educational demonstration of ML-based malware detection
• Not suitable for: Dynamic analysis, packed/obfuscated samples, or production-grade antivirus replacement

Training Data

• Dataset: fabriciojoc/brazilian-malware-dataset
• Features: Structural PE header fields (imports, sections, resources, etc.)
• Split: 80/20 train/test with stratification

Training Procedure

• Model: LightGBM (gradient boosting)
• Preprocessing: Custom pipeline in preprocessing_pipeline.joblib
• Hyperparameters: See model_metrics.json for full configuration

Performance (hold-out test set)

Artifacts

• production_model.joblib - trained LightGBM model
• preprocessing_pipeline.joblib - feature extraction pipeline
• feature_names.json - feature name mapping
• model_metrics.json - training metrics and configuration

Limitations

• Trained on PE header features only; does not analyze code behavior
• Performance may degrade on obfuscated or packed samples
• Tested on Brazilian malware dataset; generalization to other regions unverified

Citation