/projects/memory-dump-cfg-graph-malware-classification
Memory-Dump CFG and Graph-Based Malware Classification
A completed academic malware-analysis project that extracted disassembly-derived control-flow and call-graph representations and evaluated graph-based and transformer-based models for binary and multiclass malware classification.
Overview
This academic project explores malware classification from process-memory evidence through disassembly, control-flow graphs, call graphs, learned assembly representations, and graph neural networks.
Academic objective
The work tests whether executable structure recovered from memory can retain enough behavioral and semantic information for binary and malware-family classification. The pipeline emphasizes graph construction and model experimentation rather than signature matching.
My role
I developed the research pipeline and model experiments, including memory-process extraction, disassembly processing, graph construction, data preparation, training, and evaluation.
Memory and disassembly pipeline
Process artifacts are recovered from memory and passed through SMDA to identify functions, basic blocks, instructions, and control-flow relationships. The code creates per-function CFGs and a function-level call graph while retaining identifiers needed for later embedding and evaluation.
Representation learning
The repository contains a DistilBERT masked-language-model workflow for assembly tokens, frozen block-embedding generation, a GraphSAGE and DiffPool function encoder, and a graph-level classifier over function relationships. Baseline and related graph-learning experiments provide comparison points.
Dataset split
The evaluated data was divided into 70% training, 15% validation, and 15% testing. The split separates model selection from final evaluation and supports both binary and multiclass experiments.
Results
The completed evaluation reports 97% binary accuracy. For malware-family classification, the best evaluated configuration achieved 94% multiclass accuracy. The available repository confirms the model families explored but does not contain a conclusive saved artifact that ties the 94% result to one named configuration.
Limitations
The results should be interpreted within the collected dataset, recovered disassembly quality, and represented malware families. Memory corruption, incomplete process recovery, packing, and changes in the data distribution can affect graph construction and model behavior.