How to Use ML to Detect Bad?

The talk starts from a familiar bottleneck: manually analysing malware takes hours or even days per sample, and evasion techniques such as obfuscation make the work harder still. The speaker presents a web service that predicts whether a submitted file is malicious, so an analyst only needs to run the sample and gather its logs.

The training data came from a public collection of macOS malware samples. Each sample was executed in a virtual machine, its behaviour logs were captured as JSON and converted to CSV, and the records were labelled manually based on an analysis tool's output. The rest of the pipeline, covering data fetching, preprocessing, training and deployment, runs automatically through GitHub Actions. Datasets are versioned with DVC rather than Git, and experiments are tracked with MLflow. A binary classifier produces a confidence score, and only when that score is high enough does a multiclass model suggest a malware family name.

The model is served through a small Flask application packaged in Docker and hosted on Render. A live demo showed a JSON log being uploaded and returning a confidence score followed by a family name. The speaker's takeaway is that machine learning is less intimidating than it might seem. Listed improvements include collecting logs automatically from an uploaded file and speeding up slow processing on the hosting platform. The project was announced as coming soon as open source.