A Python malware analysis library. Mostly for machine learning purposes.
More info coming soon, along with my dissertation, which will go much deeper into what this is. For now, this page is all of the documentation for this project.
You can find logs from different training session in the training folder.
Please file any bugs or issues using the GitHub issues facility above.
The "master" branch is for users. The bleeding edge, and often broken, branch of "develop" is for new features.
This source code supports my dissertation. The code is not production ready until that time. Be aware that this code will change often as I add more functionality. There will be frequent breaking changes.
To run the Docker portion of this project, you will need a trained classifier that will predict classifications with the "predict_sample" function, such as the library.ml.ML class. Dill Pickle this classifier (or use train_classifier.py and the resulting saved classifier output from this script) and place it in samples/ml.dill.
Next, copy ".env.template" to ".env" and fill in any information for your instance.
Next, you can stand up this project with the following command after you have installed Docker on your system:
docker-compose up
You can rebuild all of the docker images at any time with the following command:
docker-compose build --no-cache
This was developed using Docker on a Mac. Other operating systems have not been tested (yet).
After bringing it up in Docker, you can access the web portion of this project at https://localhost. Information about the API is on the "API" page of the website.
After bringing it up in Docker, you can access the API portion of this project at https://localhost/api
After bringing it up in Docker, you can access portainer at https://localhost/portainer
Logs can be found in docker/logs in a directory for each node in the docker stack.
To use this module outside Docker, you will need the requirement. The following command installs the requirements:
pip install -r requirements.txt
If you are running Windows or macOS, please make sure the dependencies for python-magic are installed. More information can be found at https://github.com/ahupp/python-magic.
This application(s) is/are covered by the Creative Commons BY-SA license.
- https://creativecommons.org/licenses/by-sa/4.0/
- https://creativecommons.org/licenses/by-sa/4.0/legalcode
- Magic File
- PE File Structures
- ELF File Structures
- Mach-O File Structures