Classification of Malware Using Machine Learning and Sandbox-Based Analysis

Overview

An AI-driven malware analysis and classification system addressing limitations of signature-based detection by applying machine learning to static and sandbox-derived features at scale.

Problem or Opportunity

Traditional antivirus and signature-based approaches struggle to keep pace with rapidly evolving malware volumes, making scalable automated analysis increasingly important.

Proposed Solution

The project combines feature engineering, machine learning models and sandbox-based analysis methodology to support malware categorisation workflows in a research context.

Key Capabilities

• Static feature extraction from samples
• Sandbox-based behavioural analysis integration
• Machine learning classification pipelines
• Comparative model evaluation
• Structured reporting of classification results

Architecture and Workflow

Python pipelines extract features from analysed samples, transform data with Pandas and train/evaluate scikit-learn models. Sandbox outputs feed into the feature set for richer classification.

Security Considerations

• Isolated analysis environments for untrusted samples
• Controlled handling of malicious artefacts
• Research-focused scope with clear operational boundaries

Challenges and Decisions

• Feature selection across heterogeneous malware families
• Integrating static and dynamic analysis signals
• Evaluating models responsibly on imbalanced datasets