mahbub214/malware-detector repository overview

This malware detector leverages machine learning to efficiently identify malware on resource-constrained devices. It operates with only 1GB of memory and a single CPU, using static attributes of the samples for detection.

To deploy the malware detector as a web service, use the following command:

docker run --memory="1g" --cpus="1" --name malware-detector -p 8080:8080 mahbub214/malware-detector:adv-amd64

The above command optionally accepts --model (-m) and --threshold (-t) arguments. Two models are supported - metafusion-v1, metafusion-v2, and metafusion-v3. Default model is metafusion-v2 and default thresholds are metafusion-v1:0.30, metafusion-v2:0.45, metafusion-v3:0.50. To run specify model and threshold explicitly, run the following command.

docker run --memory="1g" --cpus="1" --name malware-detector -p 8080:8080 mahbub214/malware-detector:adv-amd64 -m metafusion-v2 -t 0.30

To detect if your exe file is malicious or not, use the following command:

curl --max-time 5 -X POST http://127.0.0.1:8080/ -H "Content-Type:application/octet-stream" --data-binary @yourfile.exe

The output is of {"result": <label> } format. Label 0 means the exe file is benign and 1 means it is malicious.