Malware_analysis_binary/Malware_analysis_binary_CSM.py at main · Djaferbenchadi/Malware_analysis_binary · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
#  %%
import subprocess
import hdf5storage
import numpy as np
import time

start_time = time.time()

def run_script(subdim, gdsdim):
  cmd = ['python', 'script.py','--subdim', str(subdim), '--gdsdim', str(gdsdim)]
  subprocess.run(cmd)

# List of parameter sets for Hyperparameter optimization (subspace_dimension, gds_dimension)
parameter_sets = [(i, 2*i + 28) for i in range(30, 101)]


X_safe = hdf5storage.loadmat('X_safe.mat')
X_mal = hdf5storage.loadmat('X_mal.mat')
in_mal = hdf5storage.loadmat('in_mal.mat')

X_safe = np.array(X_safe['X_safe']).T
X_mal = np.array(X_mal['X_mal']).T
in_mal = np.array(in_mal['in_mal']).T

rows, cols = X_safe.shape
# take 70% for safe train
train_rows = int(0.7 * rows)
X_safe_chosen = X_safe[:train_rows, :]

#-------------------------------------------------------------------------------
X_mal_chosen = X_mal #take everything without fold splitting
#-------------------------------------------------------------------------------
train_x = [X_safe_chosen, X_mal_chosen]
train_y = np.array([0, 1])
# Assign the remaining 30% for safe
in_safe_chosen = X_safe[train_rows:, :]
#-------------------------------------------------------------------------------
in_mal_chosen = in_mal #take everything without fold splitting
#-------------------------------------------------------------------------------


test_x = np.concatenate([in_safe_chosen, in_mal_chosen])
test_x = [test_x[i, np.newaxis, :] for i in range(test_x.shape[0])]
test_y0 = np.full(len(in_safe_chosen), 0)
test_y1 = np.full(len(in_mal_chosen), 1)
test_y = np.concatenate([test_y0, test_y1])
Accuracy = []
dimension_safe = []
dimension_mal = []


for subdim, gdsdim in parameter_sets:
  run_script(subdim, gdsdim)
  for var in list(globals().keys()):
    if var not in ['function variables','accuracy_score','get_ipython','jit','parentpath1','rand','randint','run_script','trace_this_thread','train_test_split','special variables','__','___','__doc__','__file__','__loader__','__name__','__package__','__spec__','__vsc_ipynb_file__','__builtin__','__builtins__','debugpy','exit','hdf5storage','np','os','pd','quit','random','subprocess','sys','_VSCODE_hashlib','_VSCODE_types','_dh','_VSCODE_compute_hash','_VSCODE_wrapped_run_cell','normalize', 'subdim', 'train_x','train_y','test_x','test_y','gdsdim', 'time', 'start_time']:
      del globals()[var]

  import os
  import numpy as np
  from numpy.random import randint, rand
  from sklearn.model_selection import train_test_split
  from sklearn.metrics import accuracy_score
  import hdf5storage
  import random
  import pandas as pd
  from numpy.random import randint, rand
  from numba import jit, void, f8, njit
  from sklearn.preprocessing import normalize
  import matplotlib.pyplot as plt
  from sklearn.metrics import confusion_matrix
  from sklearn.metrics import precision_score, recall_score, f1_score
  import seaborn as sns


  print("subdim:",subdim,"gdsdim:",gdsdim)

  #parameter-------------------------------------------------------------------------------
  class_num = 2
  class_info = np.array([1750, 8404]) ##for Safe + Malimg dataset
  #----------------------------------------------------------------------------------------


  #normalization---------------------------------------------------------------------------
  class_index = []
  count_c = 0
  for class_i in class_info:
      if count_c == 0:
          class_index.append(0)
          class_index.append(class_info[0])
      else:
          class_index.append(class_index[count_c] + class_info[count_c])
      count_c += 1
  class_index = np.array(class_index)

  count1 = 0
  trainBasis = []
  for train_x_i in train_x:
      train_self = train_x_i.T @ train_x_i
      w, v = np.linalg.eigh(train_self)
      w, v = w[::-1], v[:, ::-1]
      rank = np.linalg.matrix_rank(train_self)
      w, v = w[:rank], v[:, :rank]
      base = v[:, 0:subdim]
      trainBasis.append(base)

  # create gds + projection
  allbase = np.zeros((train_x[0].shape[1], train_x[0].shape[1]))
  for subspace_i in trainBasis:
      allbase += subspace_i @ subspace_i.T
  w, v = np.linalg.eigh(allbase)
  w, v = w[::-1], v[:, ::-1]
  rank = np.linalg.matrix_rank(allbase)
  w, v = w[:rank], v[:, :rank]
  gds = v[:, v.shape[1]-gdsdim:v.shape[1]]

  subspace_ongds_list = []
  for subspace_i in trainBasis:
      bases_proj = np.matmul(gds.T, subspace_i)
      qr = np.vectorize(np.linalg.qr, signature='(n,m)->(n,m),(m,m)')
      bases, _ = qr(bases_proj)
      subspace_ongds_list.append(bases)
  #------------------------------------------------------------------------------------------


  #calculate projection length--------------------------------------------------------------
  similarity_all = []
  for test_x_i in test_x:
      test_x_ongds = np.matmul(gds.T, test_x_i.T)
      similarity_one = []
      for subspace_ongds_i in subspace_ongds_list:
          length = np.linalg.norm(subspace_ongds_i.T @ test_x_ongds, ord = 2)
          similarity_one.append(length)
      similarity_all.append(np.argmax(np.array(similarity_one)))
  #------------------------------------------------------------------------------------------

  precision = precision_score(test_y, similarity_all)
  recall = recall_score(test_y, similarity_all)
  f1 = f1_score(test_y, similarity_all)
  print("Precision: {:.2f}".format(precision))
  print("Recall: {:.2f}".format(recall))
  print("F1 Score: {:.2f}".format(f1))
  print("accuracy:", accuracy_score(similarity_all, test_y))


  conf_mat = confusion_matrix(test_y, similarity_all)
  precision_class0 = conf_mat[0, 0] / (conf_mat[0, 0] + conf_mat[1, 0])
  precision_class1 = conf_mat[1, 1] / (conf_mat[1, 1] + conf_mat[0, 1])
  conf_mat_precision = np.array([[precision_class0, 1 - precision_class0], [1 - precision_class1, precision_class1]])
  sns.heatmap(conf_mat_precision, annot=True, fmt='.2f', cmap='OrRd', xticklabels=['Safe', 'Malware'], yticklabels=['Safe', 'Malware'])
  plt.xlabel('Predicted labels')
  plt.ylabel('True labels')
  plt.tight_layout()
  plt.show()

  end_time = time.time()
  elapsed_time = end_time - start_time
  print("Elapsed time: ", elapsed_time, " seconds")