Static Binary Malware Classifier using Opcode N-Grams & LightGBM
Reverse-engineering disassembly pipeline extracting x86/x64 assembly instruction N-grams to detect packed malware without sandboxing.
Project Overview
Disassembles Portable Executable (PE) Windows binaries using Capstone Engine. Extracts frequency vectors of assembly opcode sequences (e.g. push-mov-call) and PE header entropy, training a high-speed LightGBM model that flags malicious trojans in under 200 milliseconds.
Disassembles Portable Executable (PE) Windows binaries using Capstone Engine. Extracts frequency vectors of assembly opcode sequences (e.g. push-mov-call) and PE header entropy, training a high-speed LightGBM model that flags malicious trojans in under 200 milliseconds.
Reverse-engineering disassembly pipeline extracting x86/x64 assembly instruction N-grams to detect packed malware without sandboxing.