llsourcell / antivirus_demo Goto Github PK

Antivirus Demo for Fresh Machine Learning #7

License: MIT License

Python 100.00%

antivirus_demo's Introduction

Antivirus Demo

Overview

This project helps train a classifier to be able to detect PE files as either malicious or legitimate. It tries out 6 different classification algorithms before deciding which one to use for prediction by comparing their results. This is the code for 'Build an Antivirus in 5 Min' on Youtube.

Dependencies

pandas pip install pandas
numpy pip install numpy
pickle pip install pickle
scipy pip install scipy
scikit pip install -U scikit-learn

Use pip to install any missing dependencies

Basic Usage

Run python learning.py to train the model. It will train on the dataset included called 'data.csv'.
Once trained you can test the model via python checkpe.py YOUR_PE_FILE. It will output either malicious or legitimate!

That's it!

Credits

Credit for the vast majority of code here goes to Te-k. I've merely created a wrapper around all of the important functions to get people started.

antivirus_demo's People

Contributors

Stargazers

Watchers

Forkers

xwiz philkuz urwithajit9 jgabriellima sushant-dawar omkarkirpan hpkumbhar joe564338 javantea dragona oueldz4 code4days varshapwalia chromeappplayj zerocool443 onthelake ferdinandl007 dukeovdsea rootjacker tanduong thinhqt amritbhat786 prcer rootsec1 primmus lucas-developer edisplay ratchetwrench marclachapelle paulopatto truong225 vermasoumitra020 ghostonthefiber jpalanco dnhdang94 oksbsb amilasilva92 vedraiyani yassermustafa clustersdata sushantsikka surajr nikhilesh2317 lukw00heck hbibz-deploy andrewricemgw cheahengsoon isc-labs shumayi eliecerecology phonix2012 twseptian jaisimhamanipatruni rajnish-aryann bhafsa safly icipher18 sushantport kedardg tagolfirg ishaak15 chihebchebbi d2dyno1 sejun2 potatodocs co2palm shashikanthkbagali5 binaco bhumikadhawan3 shiva-karthick bbueno5000 lpcteste imendax mauriziocasciano sharrajesh souvik-debug tripleaceme warlockmdwa anupaldeka urvashivasita23 thedreamer911 zyperx mrs3ew astroguy1 chosen1 ydrgzm ai-ml-labs giantank

antivirus_demo's Issues

TabError: inconsistent use of tabs and spaces in indentation

File "checkpe.py", line 13
return 0.0
^
TabError: inconsistent use of tabs and spaces in indentation

there is tabs mixed in there, fix please

PS. i thought a PR would be hassle for this so opened this issue

Source of the data.csv file?

Can I get the source of data.csv file please?

TypeError: a bytes-like object is required, not 'str'

Traceback (most recent call last):
  File "checkpe.py", line 185, in <module>
    'r').read()
TypeError: a bytes-like object is required, not 'str'

Syntax Error

When I run checkpe.py I get the syntax error
File "checkpe.py", line 188, in <module> data = extract_infos(args.FILE) File "checkpe.py", line 108, in extract_infos res['SectionsMeanEntropy'] = sum(entropy)/float(len(entropy)) TypeError: object of type 'map' has no len()

I am a noob, so can someone help me fix this. Oh yeah and entropy = map(lambda x:x.get_entropy(), pe.sections)

Pass Cylance's 100 test

Cylance is proud of what they call the "AV 100" test.
In order to be considered an AntiVirus, this must pass the "AV 100" test.

The test works as follows:

Download 100 random samples from VT.
Scan 100 samples downloaded.
Detect 100 samples scanned.
PROFIT.

Now, CAN YOU PASS THE AV 100 TEST?

Get into VT you leeching sc*mbag!

There are two types of "AV vendors" nowadays: One is a decent contributing to society type of company, who puts the community over greed, the other is a Leeching money-hungry scum that only cares about making profit of off the work done by decent AV firms.

Which one are you? Well right now you're the bad kind, because YOU'RE NOT IN VIRUS TOTAL.

I suggest you JOIN VIRUS TOTAL TODAY before anyone denounces you for who you seem to be.

C:\Users\Electron\Desktop\wd\antivirus_demo>python learning.py
sys:1: DtypeWarning: Columns (13) have mixed types. Specify dtype option on import or set low_memory=False.
Researching important feature based on 54 total features

13 features identified as important:
1. feature DllCharacteristics (0.281040)
2. feature Machine (0.086104)
3. feature Characteristics (0.069102)
4. feature VersionInformationSize (0.064456)
5. feature SizeOfOptionalHeader (0.047274)
6. feature MajorSubsystemVersion (0.046663)
7. feature ResourcesMinSize (0.038094)
8. feature SectionsMaxEntropy (0.028874)
9. feature Subsystem (0.027956)
10. feature ResourcesMaxEntropy (0.027327)
11. feature SectionsMinEntropy (0.025751)
12. feature MinorOperatingSystemVersion (0.021324)
13. feature ExportNb (0.021009)

Now testing algorithms
DecisionTree : 98.804781 %
AdaBoost : 98.504165 %
GradientBoosting : 98.533140 %
GNB : 96.041289 %
RandomForest : 99.304600 %

Winner algorithm is RandomForest with a 99.304600 % success
Saving algorithm and feature list in classifier directory...
Traceback (most recent call last):
  File "learning.py", line 61, in <module>
    open('classifier/features.pkl', 'w').write(pickle.dumps(features))
TypeError: write() argument must be str, not bytes
C:\Users\Electron\Desktop\wd\antivirus_demo>