/projects/memory-dump-cfg-graph-malware-classification
MalGraph: Memory-Dump CFG Pipeline and Packing Study
A research pipeline for recovering code from process memory, building control-flow representations, and studying how packing changes what static disassembly can recover.
Overview
This academic project explores malware classification from process-memory evidence through disassembly, control-flow graphs, call graphs, learned assembly representations, and graph neural networks.
Academic objective
The work tests whether executable structure recovered from memory can retain enough behavioral and semantic information for binary and malware-family classification. The pipeline emphasizes graph construction and model experimentation rather than signature matching.
My role
I developed the research pipeline and model experiments, including memory-process extraction, disassembly processing, graph construction, data preparation, training, and evaluation.
Memory and disassembly pipeline
Process artifacts are recovered from memory and passed through SMDA to identify functions, basic blocks, instructions, and control-flow relationships. The code creates per-function CFGs and a function-level call graph while retaining identifiers needed for later embedding and evaluation.
Representation learning
The repository contains a DistilBERT masked-language-model workflow for assembly tokens, frozen block-embedding generation, a GraphSAGE and DiffPool function encoder, and a graph-level classifier over function relationships. Baseline and related graph-learning experiments provide comparison points.
Dataset split
The evaluated data was divided into 70% training, 15% validation, and 15% testing. The split separates model selection from final evaluation and supports both binary and multiclass experiments.
Shipped measurements
The repository reports a packing study of 32 system binaries. Static disassembly of the UPX-packed files recovered 5.4% of the functions and 4.0% of the basic blocks recovered from the originals. The repository explicitly reports no classification metrics because the labeled capture corpus is not published.
Limitations
The repository is a research artifact, not a published malware classifier. Memory corruption, incomplete process recovery, packing, and changes in the data distribution can affect graph construction and model behavior.