Spaces:
Sleeping
Sleeping
minor update
Browse files- src/engine_b/model.py +14 -10
- src/ui/app.py +57 -11
src/engine_b/model.py
CHANGED
|
@@ -1,42 +1,46 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
import torch.nn as nn
|
| 2 |
|
|
|
|
| 3 |
class MalwareCNN(nn.Module):
|
| 4 |
"""
|
| 5 |
Convolutional Neural Network for classifying malware families based on byte images.
|
| 6 |
-
|
| 7 |
Args:
|
| 8 |
num_classes (int): Number of unique malware families to classify.
|
| 9 |
"""
|
|
|
|
| 10 |
def __init__(self, num_classes=24):
|
| 11 |
super(MalwareCNN, self).__init__()
|
| 12 |
self.features = nn.Sequential(
|
| 13 |
nn.Conv2d(1, 32, kernel_size=3, padding=1),
|
| 14 |
nn.ReLU(),
|
| 15 |
-
nn.MaxPool2d(2, 2),
|
| 16 |
-
|
| 17 |
nn.Conv2d(32, 64, kernel_size=3, padding=1),
|
| 18 |
nn.ReLU(),
|
| 19 |
-
nn.MaxPool2d(2, 2),
|
| 20 |
-
|
| 21 |
nn.Conv2d(64, 128, kernel_size=3, padding=1),
|
| 22 |
nn.ReLU(),
|
| 23 |
-
nn.MaxPool2d(2, 2),
|
| 24 |
)
|
| 25 |
self.classifier = nn.Sequential(
|
| 26 |
nn.Flatten(),
|
| 27 |
nn.Linear(128 * 16 * 16, 512),
|
| 28 |
nn.ReLU(),
|
| 29 |
-
nn.Dropout(0.6),
|
| 30 |
-
nn.Linear(512, num_classes)
|
| 31 |
)
|
| 32 |
|
| 33 |
def forward(self, x):
|
| 34 |
"""
|
| 35 |
Forward pass through the CNN.
|
| 36 |
-
|
| 37 |
Args:
|
| 38 |
x (torch.Tensor): Input batch of images.
|
| 39 |
-
|
| 40 |
Returns:
|
| 41 |
torch.Tensor: Logits for each class.
|
| 42 |
"""
|
|
|
|
| 1 |
+
"""
|
| 2 |
+
Contains the CNN model for malware classification.
|
| 3 |
+
"""
|
| 4 |
+
|
| 5 |
import torch.nn as nn
|
| 6 |
|
| 7 |
+
|
| 8 |
class MalwareCNN(nn.Module):
|
| 9 |
"""
|
| 10 |
Convolutional Neural Network for classifying malware families based on byte images.
|
| 11 |
+
|
| 12 |
Args:
|
| 13 |
num_classes (int): Number of unique malware families to classify.
|
| 14 |
"""
|
| 15 |
+
|
| 16 |
def __init__(self, num_classes=24):
|
| 17 |
super(MalwareCNN, self).__init__()
|
| 18 |
self.features = nn.Sequential(
|
| 19 |
nn.Conv2d(1, 32, kernel_size=3, padding=1),
|
| 20 |
nn.ReLU(),
|
| 21 |
+
nn.MaxPool2d(2, 2), # 128 -> 64
|
|
|
|
| 22 |
nn.Conv2d(32, 64, kernel_size=3, padding=1),
|
| 23 |
nn.ReLU(),
|
| 24 |
+
nn.MaxPool2d(2, 2), # 64 -> 32
|
|
|
|
| 25 |
nn.Conv2d(64, 128, kernel_size=3, padding=1),
|
| 26 |
nn.ReLU(),
|
| 27 |
+
nn.MaxPool2d(2, 2), # 32 -> 16
|
| 28 |
)
|
| 29 |
self.classifier = nn.Sequential(
|
| 30 |
nn.Flatten(),
|
| 31 |
nn.Linear(128 * 16 * 16, 512),
|
| 32 |
nn.ReLU(),
|
| 33 |
+
nn.Dropout(0.6), # Increased dropout to prevent overfitting
|
| 34 |
+
nn.Linear(512, num_classes),
|
| 35 |
)
|
| 36 |
|
| 37 |
def forward(self, x):
|
| 38 |
"""
|
| 39 |
Forward pass through the CNN.
|
| 40 |
+
|
| 41 |
Args:
|
| 42 |
x (torch.Tensor): Input batch of images.
|
| 43 |
+
|
| 44 |
Returns:
|
| 45 |
torch.Tensor: Logits for each class.
|
| 46 |
"""
|
src/ui/app.py
CHANGED
|
@@ -62,7 +62,10 @@ def analyze_malware(file_path):
|
|
| 62 |
|
| 63 |
# Ensemble Logic
|
| 64 |
ensemble_score = (prob_a + result_b["confidence"] * 100) / 2
|
| 65 |
-
|
|
|
|
|
|
|
|
|
|
| 66 |
|
| 67 |
# Generate PDF Report
|
| 68 |
pdf_path = generate_pdf_report(
|
|
@@ -74,6 +77,8 @@ def analyze_malware(file_path):
|
|
| 74 |
prob_b=result_b["confidence"] * 100,
|
| 75 |
image_b=image_b,
|
| 76 |
ensemble_score=ensemble_score,
|
|
|
|
|
|
|
| 77 |
)
|
| 78 |
|
| 79 |
return (
|
|
@@ -97,7 +102,16 @@ def analyze_malware(file_path):
|
|
| 97 |
|
| 98 |
|
| 99 |
def generate_pdf_report(
|
| 100 |
-
file_path,
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 101 |
):
|
| 102 |
|
| 103 |
class PDFReport(FPDF):
|
|
@@ -111,12 +125,6 @@ def generate_pdf_report(
|
|
| 111 |
self.cell(0, 10, "MALWARE ANALYSIS REPORT", border=0, align="C")
|
| 112 |
self.ln(15)
|
| 113 |
|
| 114 |
-
def footer(self):
|
| 115 |
-
self.set_y(-15)
|
| 116 |
-
self.set_font("Helvetica", style="I", size=8)
|
| 117 |
-
self.set_text_color(128, 128, 128)
|
| 118 |
-
self.cell(0, 10, f"Page {self.page_no()}", align="C")
|
| 119 |
-
|
| 120 |
pdf = PDFReport()
|
| 121 |
pdf.add_page()
|
| 122 |
pdf.set_auto_page_break(auto=True, margin=15)
|
|
@@ -157,11 +165,16 @@ def generate_pdf_report(
|
|
| 157 |
)
|
| 158 |
|
| 159 |
pdf.set_font("Helvetica", size=11)
|
| 160 |
-
pdf.cell(40, 8, "
|
| 161 |
pdf.set_font("Helvetica", style="B", size=12)
|
| 162 |
-
|
| 163 |
pdf.cell(
|
| 164 |
-
0,
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 165 |
)
|
| 166 |
pdf.ln(5)
|
| 167 |
|
|
@@ -253,6 +266,39 @@ def generate_pdf_report(
|
|
| 253 |
pdf.rect(x_pos, y_pos, 70, 70)
|
| 254 |
pdf.image(img_path, x=x_pos, y=y_pos, w=70, h=70)
|
| 255 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 256 |
report_path = os.path.join(
|
| 257 |
temp_dir, f"Analysis_Report_{os.path.basename(file_path)}.pdf"
|
| 258 |
)
|
|
|
|
| 62 |
|
| 63 |
# Ensemble Logic
|
| 64 |
ensemble_score = (prob_a + result_b["confidence"] * 100) / 2
|
| 65 |
+
final_verdict_text = "MALICIOUS" if ensemble_score > 50 else "BENIGN"
|
| 66 |
+
ensemble_verdict = f"Final Verdict: {final_verdict_text} (Risk Score: {ensemble_score:.1f}/100)"
|
| 67 |
+
|
| 68 |
+
top_3_probs = sorted(all_probs.items(), key=lambda x: x[1], reverse=True)[:3]
|
| 69 |
|
| 70 |
# Generate PDF Report
|
| 71 |
pdf_path = generate_pdf_report(
|
|
|
|
| 77 |
prob_b=result_b["confidence"] * 100,
|
| 78 |
image_b=image_b,
|
| 79 |
ensemble_score=ensemble_score,
|
| 80 |
+
final_verdict=final_verdict_text,
|
| 81 |
+
top_3_probs=top_3_probs,
|
| 82 |
)
|
| 83 |
|
| 84 |
return (
|
|
|
|
| 102 |
|
| 103 |
|
| 104 |
def generate_pdf_report(
|
| 105 |
+
file_path,
|
| 106 |
+
status_a,
|
| 107 |
+
prob_a,
|
| 108 |
+
top_features,
|
| 109 |
+
family_b,
|
| 110 |
+
prob_b,
|
| 111 |
+
image_b,
|
| 112 |
+
ensemble_score,
|
| 113 |
+
final_verdict,
|
| 114 |
+
top_3_probs,
|
| 115 |
):
|
| 116 |
|
| 117 |
class PDFReport(FPDF):
|
|
|
|
| 125 |
self.cell(0, 10, "MALWARE ANALYSIS REPORT", border=0, align="C")
|
| 126 |
self.ln(15)
|
| 127 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 128 |
pdf = PDFReport()
|
| 129 |
pdf.add_page()
|
| 130 |
pdf.set_auto_page_break(auto=True, margin=15)
|
|
|
|
| 165 |
)
|
| 166 |
|
| 167 |
pdf.set_font("Helvetica", size=11)
|
| 168 |
+
pdf.cell(40, 8, "Final Verdict:", border=0)
|
| 169 |
pdf.set_font("Helvetica", style="B", size=12)
|
| 170 |
+
|
| 171 |
pdf.cell(
|
| 172 |
+
0,
|
| 173 |
+
8,
|
| 174 |
+
f"{final_verdict} (Risk Score: {ensemble_score:.1f} / 100)",
|
| 175 |
+
border=0,
|
| 176 |
+
new_x="LMARGIN",
|
| 177 |
+
new_y="NEXT",
|
| 178 |
)
|
| 179 |
pdf.ln(5)
|
| 180 |
|
|
|
|
| 266 |
pdf.rect(x_pos, y_pos, 70, 70)
|
| 267 |
pdf.image(img_path, x=x_pos, y=y_pos, w=70, h=70)
|
| 268 |
|
| 269 |
+
# Draw Top 3 Probabilities Table next to the image
|
| 270 |
+
pdf.set_y(y_pos)
|
| 271 |
+
|
| 272 |
+
# Table Header
|
| 273 |
+
pdf.set_x(x_pos + 75)
|
| 274 |
+
pdf.set_font("Helvetica", style="B", size=10)
|
| 275 |
+
pdf.cell(70, 8, "Predicted Family", border=1, fill=True)
|
| 276 |
+
pdf.cell(
|
| 277 |
+
40,
|
| 278 |
+
8,
|
| 279 |
+
"Confidence",
|
| 280 |
+
border=1,
|
| 281 |
+
new_x="LMARGIN",
|
| 282 |
+
new_y="NEXT",
|
| 283 |
+
fill=True,
|
| 284 |
+
align="C",
|
| 285 |
+
)
|
| 286 |
+
|
| 287 |
+
# Table Rows
|
| 288 |
+
pdf.set_font("Helvetica", size=10)
|
| 289 |
+
for family, prob in top_3_probs:
|
| 290 |
+
pdf.set_x(x_pos + 75)
|
| 291 |
+
pdf.cell(70, 8, f" {family}", border=1)
|
| 292 |
+
pdf.cell(
|
| 293 |
+
40,
|
| 294 |
+
8,
|
| 295 |
+
f"{prob * 100:.2f}%",
|
| 296 |
+
border=1,
|
| 297 |
+
new_x="LMARGIN",
|
| 298 |
+
new_y="NEXT",
|
| 299 |
+
align="C",
|
| 300 |
+
)
|
| 301 |
+
|
| 302 |
report_path = os.path.join(
|
| 303 |
temp_dir, f"Analysis_Report_{os.path.basename(file_path)}.pdf"
|
| 304 |
)
|