Prediction on Malware samples with SVM

This is just a fun experiment. I will try to explain what I do at each step. Let's get started.



In [2]:

    
import numpy as np
from sklearn import linear_model
from sklearn.metrics import confusion_matrix, log_loss
from sklearn.feature_extraction.text import CountVectorizer, TfidfTransformer
from sklearn.pipeline import Pipeline
from sklearn.decomposition import TruncatedSVD 
from sklearn.grid_search import GridSearchCV
from sklearn import cross_validation
import pymongo



In [12]:

    
def LCS(X, Y):
    m = len(X)
    n = len(Y)
    # An (m+1) times (n+1) matrix
    C = [[0 for j in range(n+1)] for i in range(m+1)]
    for i in range(1, m+1):
        for j in range(1, n+1):
            if X[i-1] == Y[j-1]: 
                C[i][j] = C[i-1][j-1] + 1
            else:
                C[i][j] = max(C[i][j-1], C[i-1][j])
    return C



In [4]:

    
cm = pymongo.MongoClient("afruizc-office.cs.unm.edu")
cm.malware.authenticate("populator", "malware_challenge")
samples = cm.malware.samples

samples = samples.find({"class":"5"})[:2]



In [6]:

    
seq1 = samples[0]['asm_info']['seq']
seq2 = samples[1]['asm_info']['seq']
print(len(seq1), len)



In [14]:

    
LCS(seq1, seq2)



In [11]:

    
target_names = ['Ramnit', 'Lollipop', 'Kelihos_ver3', 
                'Vundo', 'Simda', 'Tracur', 'Kelihos_ver1',
               'Obfuscator.ACY', 'Gatak']

cm = pymongo.MongoClient("afruizc-office.cs.unm.edu")
cm.malware.authenticate("populator", "malware_challenge")
samples = cm.malware.samples
data_train = [('\n'.join(x['asm_seq']['']), x['class']) 
                      for x in samples.find({
                            "id": {"$exists": True}, # The id field exists
                            "ida_comments ": {"$ne": ""}})]
                            # ^ For non-empty field



In [ ]:



In [12]:

    
X_train, Y_train = zip(*data_train)
print(len(X_train), len(Y_train))









    



10865 10865



In [13]:

    
test_samples = cm.malware.test_samples
data_test = [(x['id'], '\n'.join(x['ida_comments'])) 
                      for x in test_samples.find({
                            "id":{"$exists": True}, # The id field exists
                            "ida_comments": {"$ne": ""}})]
names, X_test = zip(*data_test)



In [14]:

    
sample_classifier = Pipeline([
        ('vectorizer', CountVectorizer()),
        ('freq_norm', TfidfTransformer()),
        ('lsa_proj', TruncatedSVD()),
        ('classifier', linear_model.SGDClassifier(loss='log'))
    ])

parameters = {'freq_norm__use_idf': (True, False),
              'classifier__alpha': (1e-2, 1e-3)}
param_tunning = GridSearchCV(sample_classifier, parameters, n_jobs=-1)



In [ ]:

    
fitted_model = param_tunning.fit(X_train, Y_train)



In [44]:

    
s









    Out[44]:





array([ 0.71336702,  0.73529412,  0.67541436,  0.72672811,  0.58248848])



In [40]:

    
model_dumb = sample_classifier.fit(X_train, Y_train)



In [18]:

    
y_pred_proba = model_dumb.predict_proba(X_test)



In [28]:

    
n = len(names)
to_print = np.column_stack((np.array(names), y_pred_proba))



In [34]:

    
np.savetxt('submission.txt', to_print, header=','.join(['id'] + \
                            ['Prediction%d' % x for x in range(1, 10)]), 
                               fmt='%s', delimiter=',')



In [3]:

    
np.column_stack









    Out[3]:





<function numpy.lib.shape_base.column_stack>



In [33]:

    
np.savetxt?



In [11]:

    
print(conf_matrix)
plt.matshow(conf_matrix)
plt.title('Confussion matrix')
plt.xlabel('True label')
plt.ylabel('Predicted label')
plt.colorbar()
plt.show()









    



[[366   6   0   0   0   0   0   1   1]
 [  2 612   0   0   0   1   0   1  14]
 [  0   0 727   2   0   0   0   0   3]
 [  1   0   0  96   0  19   1   0   3]
 [  0   4   1   0   0   0   1   0   2]
 [  9   0   0   0   0 170   2   0   2]
 [  1   0   0   3   0   0 102   2   1]
 [ 33   0   5   1   0  10   0 233  32]
 [  8   0   0   0   0   1   0   0 236]]



In [12]:

    
logloss = log_loss(y_test, y_pred_proba)
print(logloss)









    



0.334557596356