ammminnne/MalwareDetection-App

🛡️ Guardian: An out-of-core machine learning framework and decoupled client-server mobile ecosystem for real-time, cross-platform malware detection (96.61% accuracy at 8.4µs latency). | Master's Thesis PFE @ Constantine 2 University. # 🛡️ Guardian: A Machine Learning-Based Approach for Malware Detection **Guardian** is an end-to-end, real-time cybersecurity ecosystem designed to detect zero-day and polymorphic malware across cross-platform environments (Windows PE & Android APKs). Built as a Master's Graduation Project (PFE - *Projet de Fin d'Études*), this framework overcomes the hardware limitations of mobile edge devices through a **decoupled client-server architecture** and an aggressive **feature surface distillation pipeline**. --- ## 🌟 Key Architectural Breakthroughs * **🔬 Denoised Malware Surface Distillation:** Reduced the raw 140GB EMBER benchmark dataset from **2,568 raw structural features down to an optimal 150-feature subdataset** using a Global Gain vs. SHAP explainability tournament. This achieved a **93.7% feature footprint reduction** while increasing baseline accuracy. * **⚙️ Thrember Parser Engine:** A custom vector extraction engine (backed by `LIEF` and `pefile`) that extracts byte histograms, structural headers, API import/export tables, and byte-entropy metrics in real time. * **⚡ Out-of-Core ML Pipeline:** Trained using memory-mapped streaming (`numpy.memmap`) in 10,000-sample chunks with 32-bit floating-point precision, keeping physical RAM usage locked **under 5 GB** during training. * **🚀 Sub-Second RAM-Resident Backend:** A high-speed Python Flask REST API where compiled **LightGBM** models are pre-loaded directly into volatile system memory using `joblib`, completely eliminating disk read latency during live scans. * **📱 Guardian Mobile Client:** A cross-platform mobile application engineered with **Flutter & Dart**, featuring a dark-mode cybersecurity UI, real-time SafeScan threat indicators, scan history logging, and automated **PDF security audit report generation**. --- ## 🏗️ System Architecture The ecosystem relies on a decoupled design to preserve smartphone battery and CPU performance: ```text +-----------------------+ Secure HTTP / JSON …