License:
"""
The BSD License
Copyright (c) 2012, Adobe Systems Incorporated
All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-Neither the name of the Adobe Systems Incorporated nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL Adobe Systems Incorporated OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
"""
# Adobe(R) Malware Classifier
# Contributor: Karthik Raman, Adobe Systems Incorporated
# Dependencies: Python pefile, Python argparse
# Program to classify unknown Win32 binaries (EXEs or DLLs) into
# 0 = CLEAN
# 1 = DIRTY
# UNKNOWN
""" Results on dataset of ~130000 dirty, ~ 16000 clean files:
(False Positives, True Negatives, True Positives, rates
J48 FP TN TP FN TP Rate FP Rate Accuracy
7683 37171 130302 3451 0.97419871 0.171289071 0.937662018
J48Graft FP TN TP FN TP Rate FP Rate Accuracy
6780 38074 129087 4666 0.965114801 0.151157087 0.935915166
PART FP TN TP FN TP Rate FP Rate Accuracy
7074 36492 125060 9412 0.930007734 0.162374329 0.907401791
Ridor FP TN TP FN TP Rate FP Rate Accuracy
7390 37935 114194 20930 0.845105237 0.163044677 0.843058149
"""
usage: AdobeMalwareClassifier.py [-h] [-f filename] [-n model] [-v [verbose]]
Classify an unknown binary as MALWARE or CLEAN.
optional arguments:
-h, --help show this help message and exit
-f filename The name of the input file
-n model The ordinal for model classifier: 0=all (default) | 1=J48 |
2=J48Graft | 3=PART | 4=Ridor
-v [verbose] Dump the PE data being processed
