This is the implementation of MalConv proposed in [Malware Detection by Eating a Whole EXE](https://arxiv.org/abs/1710.09435) and its adversarial sample crafting.
MalConv-keras
A Keras implementation of MalConv and adversarial sampleDesciprtion
This is the implementation of MalConv proposed in Malware Detection by Eating a Whole EXE which can be used for any very long sequence classification.
The adversarial samples are crafted by padding some bytes to the input file. It would fail if the origin file length exceeds the model's input size.
Enjoy !
Requirement
- python3 (3.5.2)
- numpy (1.13.1)
- pandas (0.22.0)
- pickle (0.7.4)
- keras (2.1.5)
- tensorflow (1.6.0)
- sklearn
Get started
Clone the repository
git clone https://github.com/j40903272/MalConv-kerasPrepare data
Prepare a csv file with filenames(absolute or relative path) and labels in the0778a070b283d5f4057aeb3b42d58b82ed20e4eb_f205bd9628ff8dd7d99771f13422a665a70bb916, 0
fbd1a4b23eff620c1a36f7c9d48590d2fccda4c2_cc82281bc576f716d9a0271d206beb81ad078b53, 0Training
python3 train.py example.csv
python3 train.py example.csv --resumePredict
python3 predict.py example.csv
python3 predict.py example.csv --result_path saved/result.csvPreprocess
If you require the preprocessed data, run the followingpython3 preprocess.py example.csv
python3 preprocess.py example.csv --savepath saved/preprocessdata.pklAdversarial
Try different --step_size, it's quite sensitivepython3 gen_adversarial.py example.csv
python3 genadversarial.py example.csv --savepath saved/adversarialsamples --padpercent 0.1
for multiple class classification
python3 gen_adversarial2.py example.csv --class 1< Notice > The generated padding bytes sometimes cannot be corrected encoded, a workaround is as follow :
# Read bytes then tokenize byte_content = open('target', 'rb').read() content = [chr(i) for i in byte_content]Parameters
Find out more options with-h
python3 train.py -h
-h, --help --batchsize BATCHSIZE --verbose VERBOSE --epochs EPOCHS --limit LIMIT --maxlen MAXLEN --winsize WINSIZE --valsize VALSIZE --savepath SAVEPATH --save_best --resume python3 predict.py -h python3 preprocess.py -h
Logs and checkpoint
The default path for output files would all be in saved/Example
from malconv import Malconv
from preprocess import preprocess
import utils
model = Malconv() model.compile(loss='binary_crossentropy', optimizer='adam', metrics=['acc'])
df = pd.read_csv(input.csv, header=None) filenames, label = df[0].values, df[1].values data = preprocess(filenames) xtrain, xtest, ytrain, ytest = utils.traintestsplit(data, label)
history = model.fit(xtrain, ytrain) pred = model.predict(x_test)
