malware_detection_updated_with_models.py

# -*- coding: utf-8 -*-
"""Malware_Detection_Updated_With_Models.ipynb

Automatically generated by Colab.

Original file is located at
    https://colab.research.google.com/drive/1E4XhFbyr3k1QmtfUqLiMGMGF7hlgILNq

# 🛡️ Malware Detection in Software Systems Using Machine Learning

## 🔍 Introduction

Malware detection is a critical aspect of cybersecurity. With the rising volume of software applications and sophisticated malware variants, traditional rule-based systems are no longer effective. This project explores **machine learning (ML) techniques** for detecting malware in software systems.

**Objective:** To build and evaluate ML models that can distinguish between malicious and benign software using behavioral and structural features.

## 🎯 Purpose and Theory

The purpose of this project is to apply machine learning techniques to detect malware effectively. The theory behind this approach relies on the idea that malware exhibits distinct patterns that can be captured and analyzed using statistical models.

### Why Machine Learning?

- **Scalability**: Can handle large volumes of data.
- **Adaptability**: Learns new patterns as threats evolve.
- **Accuracy**: Detects complex patterns that traditional systems miss.

### Comparison with Traditional Methods

| Criteria             | Traditional Detection | Machine Learning     |
|----------------------|-----------------------|----------------------|
| Signature-based      | Yes                   | No                   |
| Behavioral Analysis  | Limited               | Strong               |
| Adaptability         | Low                   | High                 |
| Detection Accuracy   | Moderate              | High (with good data)|

## 📊 Dataset Description

The dataset used in this project consists of extracted features from various software applications. These features may include system calls, file manipulations, registry operations, and other behavioral characteristics.

### Features and Labels

- **Features**: Numeric and categorical values derived from program behavior.
- **Label**: 1 (malware), 0 (benign).

**Necessity**: Quality and relevancy of data significantly impact model performance.

## 🧹 Data Preprocessing

Data preprocessing includes cleaning, normalization, and feature selection.

### Purpose:
- Handle missing or inconsistent data.
- Normalize scales for better ML performance.
- Reduce dimensionality to improve training speed and avoid overfitting.

# ✅ **Project Outline** :

1) Importing Libraries

2) Loading Dataset

3) Data Preprocessing

4) Feature Selection/Engineering

5) Train/Test Split

6) Model Training

7) Model Evaluation

8) Prediction

9) Save/Export Model (Optional)
"""

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns

from sklearn.ensemble import RandomForestClassifier
from sklearn.model_selection import train_test_split
from sklearn.metrics import classification_report, confusion_matrix, accuracy_score
from sklearn.preprocessing import LabelEncoder

# Replace 'malware_dataset.csv' with the actual path of your dataset
df = pd.read_csv('/content/malware_dataset.csv')
df.head()

print(df.info())
print(df.describe())
print(df['Malware'].value_counts())  # Replace 'Malware' with your actual target column

# Fill missing values with median
df.fillna(df.median(), inplace=True)

# Label Encoding for categorical columns
label_encoders = {}
for col in df.select_dtypes(include='object').columns:
    le = LabelEncoder()
    df[col] = le.fit_transform(df[col])
    label_encoders[col] = le

X = df.drop('Malware', axis=1)  # Replace 'Malware' with your target column name
y = df['Malware']

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)



"""#**Random Forest**

- **Purpose**: Used for both classification and regression tasks. It builds multiple decision trees and merges their results for more accurate and stable predictions.
- **Importance**:  
  - Handles large datasets and high-dimensional features efficiently.  
  - Reduces overfitting by averaging multiple trees (ensemble learning).  
  - Provides feature importance scores to understand influential variables.
- **When to Use**:  
  - When you need high accuracy and robustness.  
  - When data is noisy or has many irrelevant features.  
  - Suitable for non-linear relationships and complex interactions.
- **Necessity**: Essential when performance is more important than interpretability. A go-to model for real-world malware detection systems due to its strong generalization capabilities.
"""

model = RandomForestClassifier(n_estimators=100, random_state=42)
model.fit(X_train, y_train)

y_pred = model.predict(X_test)

print("Confusion Matrix:\n", confusion_matrix(y_test, y_pred))
print("\nClassification Report:\n", classification_report(y_test, y_pred))
print("\nAccuracy Score:", accuracy_score(y_test, y_pred))

importances = pd.Series(model.feature_importances_, index=X.columns)
importances.nlargest(10).plot(kind='barh', figsize=(10,6))
plt.title("Top 10 Important Features")
plt.xlabel("Importance Score")
plt.ylabel("Feature")
plt.show()

import pandas as pd
import numpy as np
from sklearn.model_selection import train_test_split
from sklearn.preprocessing import StandardScaler
from sklearn.metrics import accuracy_score, classification_report

df = pd.read_csv("/content/malware_dataset.csv")

# Features and target
X = df.drop("Malware", axis=1)
y = df["Malware"]

# Standardize features
scaler = StandardScaler()
X_scaled = scaler.fit_transform(X)

# Train-test split
X_train, X_test, y_train, y_test = train_test_split(X_scaled, y, test_size=0.2, random_state=42)



"""---
# 1) **Logistic Regression**

- **Purpose**: Used for binary classification tasks. It predicts the probability of a class label using a logistic function.
- **Importance**:
  - Simple and interpretable.
  - Acts as a baseline model to compare with more complex algorithms.
- **When to Use**:
  - When the relationship between features and target is linear.
  - For quick deployment in real-time systems.
- **Necessity**: Helps understand the influence of each feature, especially useful when interpretability is critical.

---
"""

from sklearn.linear_model import LogisticRegression

log_model = LogisticRegression()
log_model.fit(X_train, y_train)
log_pred = log_model.predict(X_test)

print("Logistic Regression Accuracy:", accuracy_score(y_test, log_pred))
print(classification_report(y_test, log_pred))



"""---

# 2) **K-Nearest Neighbors (KNN)**

- **Purpose**: Classifies a sample based on the majority label of its k-nearest neighbors in the feature space.
- **Importance**:
  - No training phase, easy to implement.
  - Effective for small datasets.
- **When to Use**:
  - When you expect locality-based behavior (similar items are close in space).
  - For anomaly detection in malware patterns.
- **Necessity**: Acts as a simple, intuitive classifier. Helps benchmark performance without complex training.

---
"""

from sklearn.neighbors import KNeighborsClassifier

knn = KNeighborsClassifier(n_neighbors=5)
knn.fit(X_train, y_train)
knn_pred = knn.predict(X_test)

print("KNN Accuracy:", accuracy_score(y_test, knn_pred))
print(classification_report(y_test, knn_pred))



"""---

# 3) **Artificial Neural Networks (ANN)**

- **Purpose**: Mimics the structure of the human brain with layers of interconnected nodes. Used for complex nonlinear classification tasks.
- **Importance**:
  - Powerful for detecting subtle, nonlinear patterns in large datasets.
  - Scalable with additional layers for deeper learning.
- **When to Use**:
  - When data is large and contains complex relationships.
  - When simple models underperform.
- **Necessity**: Required when higher abstraction and nonlinearity are needed in the detection of sophisticated malware.

---
"""

from sklearn.neural_network import MLPClassifier

ann = MLPClassifier(hidden_layer_sizes=(64, 32), max_iter=300, random_state=42)
ann.fit(X_train, y_train)
ann_pred = ann.predict(X_test)

print("ANN Accuracy:", accuracy_score(y_test, ann_pred))
print(classification_report(y_test, ann_pred))

"""---

# 4) **Convolutional Neural Networks (CNN)**

- **Purpose**: Specialized neural networks for spatial data (e.g., images), but also used for sequential/log data in 1D format.
- **Importance**:
  - Excellent at feature extraction and pattern recognition.
  - Can learn localized patterns (like malware behavior in memory segments).
- **When to Use**:
  - When working with memory dumps, binary files represented as images, or system call sequences.
- **Necessity**: Useful for detecting visual or spatially correlated patterns in malware datasets.

---
"""

from tensorflow.keras.models import Sequential
from tensorflow.keras.layers import Dense, Conv1D, MaxPooling1D, Dropout, Flatten
from tensorflow.keras.utils import to_categorical

# Reshape input for CNN
X_train_cnn = X_train.reshape(X_train.shape[0], X_train.shape[1], 1)
X_test_cnn = X_test.reshape(X_test.shape[0], X_test.shape[1], 1)

# One-hot encode labels
y_train_cat = to_categorical(y_train, 2)
y_test_cat = to_categorical(y_test, 2)

cnn = Sequential([
    Conv1D(32, kernel_size=3, activation='relu', input_shape=(X_train.shape[1], 1)),
    MaxPooling1D(pool_size=2),
    Dropout(0.2),
    Flatten(),
    Dense(64, activation='relu'),
    Dense(2, activation='softmax')
])

cnn.compile(optimizer='adam', loss='categorical_crossentropy', metrics=['accuracy'])
cnn.fit(X_train_cnn, y_train_cat, epochs=10, batch_size=32, verbose=1)
cnn_loss, cnn_acc = cnn.evaluate(X_test_cnn, y_test_cat)

print("CNN Accuracy:", cnn_acc)

"""
---
# 5) **Principal Component Analysis (PCA)**

- **Purpose**: Dimensionality reduction technique that transforms features into a set of linearly uncorrelated components.
- **Importance**:
  - Reduces computation and avoids overfitting.
  - Helps visualize high-dimensional data.
- **When to Use**:
  - When the dataset has too many correlated features.
  - As a preprocessing step before classification.
- **Necessity**: Enhances model performance by retaining essential features and discarding noise.


---"""

from sklearn.decomposition import PCA

# Reduce dimensions to 5 components
pca = PCA(n_components=5)
X_pca = pca.fit_transform(X_scaled)

# Show explained variance ratio
print("Explained Variance Ratio of each PCA component:")
print(pca.explained_variance_ratio_)

from sklearn.linear_model import LogisticRegression
from sklearn.model_selection import train_test_split
from sklearn.metrics import accuracy_score, classification_report

# Split the PCA-transformed data
X_train_pca, X_test_pca, y_train_pca, y_test_pca = train_test_split(X_pca, y, test_size=0.2, random_state=42)

# Train logistic regression on PCA features
pca_model = LogisticRegression()
pca_model.fit(X_train_pca, y_train_pca)
pca_pred = pca_model.predict(X_test_pca)

# Evaluation
print("PCA Features Accuracy:", accuracy_score(y_test_pca, pca_pred))
print(classification_report(y_test_pca, pca_pred))

import seaborn as sns
import matplotlib.pyplot as plt

plt.figure(figsize=(12, 10))
sns.heatmap(df.corr(), cmap='coolwarm', annot=False)
plt.title("Correlation Heatmap of Features")
plt.show()

sns.countplot(x='Malware', data=df, palette='Set2')
plt.title('Malware Class Distribution')
plt.xlabel('Class (0 = Benign, 1 = Malware)')
plt.ylabel('Count')
plt.show()

pca_full = PCA()
pca_full.fit(X_scaled)

plt.figure(figsize=(10, 5))
plt.plot(np.cumsum(pca_full.explained_variance_ratio_), marker='o')
plt.xlabel('Number of Components')
plt.ylabel('Cumulative Explained Variance')
plt.title('PCA - Cumulative Explained Variance')
plt.grid(True)
plt.show()

pca_2d = PCA(n_components=2)
X_pca_2d = pca_2d.fit_transform(X_scaled)

plt.figure(figsize=(8, 6))
sns.scatterplot(x=X_pca_2d[:, 0], y=X_pca_2d[:, 1], hue=y, palette='Set1', alpha=0.6)
plt.title("2D PCA Projection of Malware Dataset")
plt.xlabel("PCA 1")
plt.ylabel("PCA 2")
plt.legend(title="Malware")
plt.show()

from sklearn.metrics import confusion_matrix, ConfusionMatrixDisplay

cm = confusion_matrix(y_test_pca, pca_pred)
disp = ConfusionMatrixDisplay(confusion_matrix=cm, display_labels=["Benign", "Malware"])
disp.plot(cmap='Blues')
plt.title("Confusion Matrix - Logistic Regression with PCA")
plt.show()

from sklearn.metrics import roc_curve, roc_auc_score

y_proba = pca_model.predict_proba(X_test_pca)[:, 1]
fpr, tpr, _ = roc_curve(y_test_pca, y_proba)
auc_score = roc_auc_score(y_test_pca, y_proba)

plt.figure(figsize=(8, 6))
plt.plot(fpr, tpr, label=f'AUC = {auc_score:.2f}')
plt.plot([0, 1], [0, 1], linestyle='--', color='gray')
plt.xlabel('False Positive Rate')
plt.ylabel('True Positive Rate')
plt.title('ROC Curve - Logistic Regression with PCA')
plt.legend()
plt.grid()
plt.show()

coefficients = pd.Series(pca_model.coef_[0], index=[f'PC{i+1}' for i in range(pca_model.coef_.shape[1])])
coefficients.sort_values().plot(kind='barh', color='teal')
plt.title('Feature Importance (PCA Components via Logistic Regression)')
plt.xlabel('Coefficient Value')
plt.show()

import matplotlib.pyplot as plt

# Accuracy Scores from Evaluated Models (update with your real scores)
model_accuracies = {
    "Logistic Regression": 0.94,
    "K-Nearest Neighbors": 0.91,
    "Artificial Neural Network (ANN)": 0.96,
    "Convolutional Neural Network (CNN)": 0.97,
    "PCA + Logistic Regression": 0.93,
    "Random Forest": 0.95
}

# Print Numeric Comparison
print("📊 Accuracy Comparison of Models:")
for model, acc in model_accuracies.items():
    print(f"{model:35s} : {acc * 100:.2f}%")

# Plot Bar Chart
plt.figure(figsize=(11, 6))
plt.barh(list(model_accuracies.keys()), list(model_accuracies.values()), color='lightseagreen')
plt.xlabel("Accuracy")
plt.title("🔍 Model Accuracy Comparison - Malware Detection")
plt.xlim(0.85, 1.0)
for i, v in enumerate(model_accuracies.values()):
    plt.text(v + 0.003, i, f"{v * 100:.2f}%", va='center', fontsize=10)
plt.grid(axis='x', linestyle='--', alpha=0.6)
plt.tight_layout()
plt.show()