Microsoft Malware Detection

Business Problem

In the past few years, the malware industry has grown very rapidly, this indicates that malwares nowadays evade traditional protection, forcing the anti-malware groups/communities to build more robust softwares to detect and terminate these attacks. The major part of protecting a computer system from a malware attack is to identify whether a given piece of file/software is a malware.

Microsoft has been very active in building anti-malware products over the years and it runs it’s anti-malware utilities over 150 million computers around the world. This generates tens of millions of daily data points to be analyzed as potential malware. In order to be effective in analyzing and classifying such large amounts of data, we need to be able to group them into groups and identify their respective families.

What is Malware ?

• Malware is intrusive software that is designed to damage and destroy computers and computer systems. Malware is a contraction for “malicious software.” Examples of common malware includes viruses, worms, Trojan viruses, spyware, adware, and ransomware. Reference

Problem Statement

In the past few years, the malware industry has grown very rapidly that, the syndicates invest heavily in technologies to evade traditional protection, forcing the anti-malware groups/communities to build more robust softwares to detect and terminate these attacks. The major part of protecting a computer system from a malware attack is to identify whether a given piece of file/software is a malware.

Microsoft has been very active in building anti-malware products over the years and it runs it’s anti-malware utilities over 150 million computers around the world. This generates tens of millions of daily data points to be analyzed as potential malware. In order to be effective in analyzing and classifying such large amounts of data, we need to be able to group them into groups and identify their respective families. Here the dataset provided by Microsoft contains about 9 classes of malware. The problem statement is to build a robust multi class classification model that can accurately classify which class a malware belongs to.

Source: Kaggle

Business Objectives and Constraints

• Minimize multi-class error.
• Multi-class probability estimates.
• Malware detection should not take hours and block the user's computer. It should fininsh in a few seconds or a minute.

Data Overview

• For every malware, we have two files

1. .asm file (read more: https://www.reviversoft.com/file-extensions/asm)
2. .bytes file (the raw data contains the hexadecimal representation of the file's binary content, without the PE header)

• Total train dataset consist of 200GB data out of which 50Gb of data is .bytes files and 150GB of data is .asm files: Lots of Data for a single-box/computer.
• There are total 10,868 .bytes files and 10,868 asm files total 21,736 files
• There are 9 types of malwares (9 classes) in our given data

Types of Malware

1. Ramnit
2. Lollipop
3. Kelihos_ver3
4. Vundo
5. Simda
6. Tracur
7. Kelihos_ver1
8. Obfuscator.ACY
9. Gatak

• For each file, the raw data contains the hexadecimal representation of the file's binary content, without the PE header (to ensure sterility). You are also provided a metadata manifest, which is a log containing various metadata information extracted from the binary, such as function calls, strings, etc. This was generated using the IDA disassembler tool. Your task is to develop the best mechanism for classifying files in the test set into their respective family affiliations.

High Level Steps to Run Case Study

1. Data overview
2. Mapping the real world problem to ml problem
3. Data Preprocessing and Exploratory Data Analysis(EDA)
4. Train,Test and CV split
5. Modeling
6. Prediction

Major Challenges

1. Disk Space (This case study requires approx. 200 GB free space on your disk)
2. Time [Approx. 48+ hrs to fetch Features from asm files (150 GB)]. In this case study I used already extracted feature files for both .asm and .byte
3. Feature Engineering (Image Based Features Extraction from asm files)

Click Here To Check Total Work on This Case Study.

Machine Learning Models

Models	Log Loss
Random Forest Classifier	0.021
XG Boost Classifier	0.023