Real-Time Malware Detection System

A real-time malware detection system built in Python that combines static file analysis with a hybrid machine learning model (Random Forest + LightGBM + MLP) to automatically scan, classify, and quarantine suspicious files as they appear on your system — with live desktop notifications and a web dashboard.

---

Features

• Real-time file monitoring — watches Desktop, Downloads, Documents, and any connected pendrive/USB drive for new or modified files.
• Hybrid ML detection — combines Random Forest, LightGBM, and MLP predictions (trained on the EMBER dataset) for PE (.exe, .dll, etc.) files.
• Static analysis engine — checks file entropy, PE imports, section counts, and other heuristics for files the ML model doesn't cover.
• Automatic quarantine — moves files flagged as SUSPICIOUS or MALWARE to a safe quarantine folder.
• Desktop popup notifications — get an instant Windows notification with the verdict for every scanned file.
• Web dashboard — a Flask-based UI to view scan history, quarantine files, restore/delete history, and run manual scans.
• Smart filtering — ignores OS metadata, temp/partial downloads, and the app's own project folder to avoid false triggers and feedback loops.

---

How It Works

New file appears (Downloads / Desktop / USB)
            │
            ▼
   Static Analysis (entropy, PE imports, file type)
            │
            ▼
  Is it a PE file (.exe/.dll)?
     │                  │
    Yes                 No
     │                  │
     ▼                  ▼
 Hybrid ML Model    Rule-based risk score
 (RF + LightGBM +          │
      MLP)                 │
     │                     │
     └────────┬────────────┘
              ▼
      Verdict: SAFE / SUSPICIOUS / MALWARE
              │
              ▼
   SUSPICIOUS or MALWARE → Auto-Quarantine
              │
              ▼
    Popup Notification + Dashboard Log

---

Tech Stack

Category	Tools / Libraries
Language	Python 3
ML	scikit-learn (Random Forest, MLP), LightGBM, EMBER feature extraction
Static Analysis	pefile, pypdf
Real-time Monitoring	watchdog, psutil
Notifications	plyer
Web Dashboard	Flask, HTML/CSS/JS
Dataset	EMBER 2018

---

Project Structure

MalwareDetection/
├── src/                    # Core detection engine
│   ├── config.py           # Central configuration (paths, thresholds)
│   ├── file_analyzer.py    # Static analysis (entropy, PE imports, etc.)
│   ├── ml_detector.py      # Loads hybrid model, computes ML verdicts
│   ├── hybrid_model.py     # Model training/combination logic
│   ├── realtime_monitor.py # Watches folders and drives, triggers scans
│   ├── quarantine.py       # Moves/restores quarantined files
│   ├── restore_exclusions.py
│   ├── train_hybrid.py     # Model training script
│   ├── evaluate_model.py   # Accuracy evaluation on unseen test data
│   ├── calibrate_hybrid.py # Threshold/weight calibration
│   └── main.py             # Entry point — starts the real-time monitor
├── dashboard/               # Flask web dashboard
│   ├── app.py
│   ├── templates/
│   └── static/
├── model/                   # Trained model + calibration files
├── quarantine/               # Quarantined files land here
├── logs/                    # scan_history.jsonl and related logs
├── WatchFolder/              # Safe folder for manual test files
├── requirements.txt
└── start_monitor_silently.vbs   # Runs the monitor in the background at startup

---

Setup

1. Clone the repository

   git clone https://github.com/raahulpatel07/MalwareDetection.git
   cd MalwareDetection
   

2. Create and activate a virtual environment

   python -m venv venv
   venv\Scripts\activate
   

3. Install dependencies

   pip install -r requirements.txt
   

4. Install EMBER (not available on PyPI, installed directly from GitHub)

   pip install git+https://github.com/elastic/ember.git
   

5. Add the EMBER dataset — download separately (excluded from this repo due to size) and place it under dataset/ember2018/ as referenced in src/config.py.

---

Usage

Start the real-time monitor:

cd src
python main.py

Start the web dashboard (in a separate terminal):

cd dashboard
python app.py

Then open http://127.0.0.1:5000 in your browser.

Run it silently in the background on startup: place a shortcut to start_monitor_silently.vbs in your Windows Startup folder (Win + R → shell:startup).

---

Model Performance

Evaluated on unseen EMBER test data:

Metric	Score
Accuracy	91.8%
Precision (Malware)	92.8%
Recall (Malware)	90.6%
F1-score	91.7%

---

Known Limitations

• Static analysis for non-PE files (images, text, archives) is heuristic-based and doesn't run the ML model.
• Legitimate packed/compressed installers can occasionally be flagged as SUSPICIOUS due to high entropy — a known trade-off of heuristic-based detection.
• EMBER feature extraction may show minor inconsistencies if the installed lief library version differs from the one EMBER was originally built against.

---

Author

Built by Rahul Patel as a final year project.

License

This project is licensed under the MIT License — feel free to use, modify, and learn from it.