tf-branch-malware

Behavior based malware detection using branch data

• Copyright (c) 2019 YoungJoong Kim. tf-branch-malware is licensed under the MIT license.
• This repository aims to write the poc code of branch based malware detection.

Environments

Tested environments

• Windows 10
• Python 3.7

Requirements

Tested requirements

• numpy==1.16.2
• SQLAlchemy==1.3.1
• tensorflow-gpu==1.14.0

Usage

Download the sample log files from releases and unzip it.

Move log directories to cloned repository.

mv log tf-branch-malware\log

Preprocess the raw log files and data directory will be generated.

cd tf-branch-malware
python -m utils.preprocess

Train the model.

python -m classifier.train

Tensorboard support.

tensorboard --logdir=.\summary

Inference sample dataset.

python -m classifier.inference

SQLite support

For using sqlite database, generate malware db first.

python -m utils.malwaredb --debug

Start sqlite.

sqlite3 ./data/malware.db
select name from malware where id=4;
select symbol from branch where malware_id=4;

DB schema.

Table malware

column	type	content
id	Integer	identifier, primary key
name	String	name of the malware

Table branch

column	type	content
id	Integer	identifier, primary key
order	Integer	order of branch data
src_addr	Integer	source address
dst_addr	Integer	destination address
dll	String	name of the dll
symbol	String	symbol of the destination address
malware_id	Integer	foreign key of malware.id