ML-Based Malware Detector

A web app that scans Windows .exe files and classifies them as malicious or benign using static analysis, no execution or sandboxing required.

Built for ENEE457 (Computer Systems Security) at the University of Maryland, Fall 2025.

How It Works

1. User uploads a PE file through the web interface
2. The backend extracts 2,568 static features from the file's structure (imports, headers, byte entropy, sections, strings) using thrember
3. Features are normalized with StandardScaler and passed to a trained XGBoost classifier
4. The model returns a malware probability; scores above 0.5 are flagged malicious

No code is executed from the uploaded file. Everything runs on structural analysis.

Running It

Requires Python 3.10+ and UV.

uv sync --extra ember2024
uv run code/standalone_app/app.py
# Open http://localhost:8000

Results

Trained on EMBER 2024 (~3.2 million samples, XGBoost):

Metric	EMBER test set	Fresh samples (Dec 2024)
Accuracy	98.4%	93.2%
Precision	98.9%	100% (0 false positives)
Recall	98.0%	90.0%
ROC-AUC	99.9%	—

An older model trained on EMBER 2018 data only caught 29% of the same fresh malware, compared to 90% with the 2024 model, showing that training data recency is the dominant factor.

Evaluation plots (confusion matrices, feature importance, model comparisons) are in evaluation/results/.

Project Structure

code/
├── standalone_app/    # FastAPI server + pre-built React UI (single port)
├── backend/           # Alternate FastAPI backend (EMBER 2018 model)
└── frontend/          # React/Vite source for the scanner UI
evaluation/
└── results/           # Confusion matrices, comparison charts, JSON metrics

Team

Samuel Kirub (ML training), Nathaniel Nelson (GUI design), Vaibhav Garg (GUI implementation), Stephen Jardim (integration)