Package: detexe
DetEXEA tool to build and analyze static malware detectors, based on machine learning.DetEXE allows the selection of different features to train malware detectors through the LightGBM framework.
The project is developed in a way that users can contribute by adding new features and combining them.
It also offers the the options to compare the created models and evaluate the detectors' robustness by perturbing malware files.InstallationTo install the latest version:$pipinstalldetexeSetupSet up DetEXE environment variable.$exportDETEXE_ROOT=$PWDCreate a project layout containing the needed directories to store the data of the project.$detexesetupAdd executable samples to the benign and malware directories. You can obtain them from different sources.
SOREL, ViruSshare... (As you are working with malware samples, please, take the safety measures).Configure the features_selection.txt file with the features you wish to extract from the files.In case you would like to select the feature OpCodeVectors, you will need to use previously the following command,
to create the W2V model.$detexeopcodesw2vHow to useCLITrain your model.$detexetrain--model="foo"Execute adversarial attacks on your trained model.It is possible to select one specific attack, or all ddiferent attacks with one command:$detexeattackpadding--model="foo"--malware="/malware/path.exe"$detexeattackall--model="foo"--malware="/malware/path.exe"Compare the trained models.$detexecompareSearch for optimal parameters to obtain better result in training. These parameters will be saved in the model directory.$detexetune--model="foo"Scan a PE file with a trained model.$detexescan--model="foo"--exe="/malware/path.exe"PythonImport functions and classes.importosfromdetexeimportconfigure_layout,train_opcode_vectors,Detector,Attacker,compareSetup project directories.os.environ["DETEXE_ROOT"]=os.path.dirname(os.path.abspath(__file__))configure_layout()Configure the features_selection.txt file with the features you wish to extract from the files.In case you would like to select the feature OpCodeVectors, you will need to train previously the W2V model.train_opcode_vectors()Instanciate a detector objectdetector=Detector(model="model_foo",config_features="/path/to/features_selection.txt")With the instance of detector you will be able to train, tune and scan.detector.train()# Train the modeldetector.tune()# Tune the hyperparametersdetector.scan("/path/to/exe")# Scan a fileThe efficiency of the created models can be compared, and visualized in a created graph.compare("model_comparation.png")Evaluate the robustness of a certain model.attacker=Attacker(model="model_foo")attacker.malware("/path/to/malware.exe")# Choose the malware to ve modified for attacking the model.attacker.all_attacks()# Choose one specific attack or all.Add your own featuresAdd new feature class in separated file under ./detexe/ped/features/your_feature.Update ./features_selection.txt file.Built WithLIEF- A cross-platform library which can parse, modify and abstract ELF, PE and MachO formats.EMBER- Elastic Malware Benchmark for Empowering Researchers.SecML Malware-  Python library for creating adversarial attacks against Windows Malware detectors.