Problem and approach
Binary files can exhibit measurable static characteristics such as executable format metadata, headers and entropy. The project explores using these features as inputs to classification models; static analysis is one signal, not definitive proof of malicious behavior.
Technical design
The codebase documents feature extraction and model inference using Python and scikit-learn, a FastAPI-facing interface and SHAP-based interpretation of predictions. Explainability helps examine which extracted features influence a classification.
Limitations and use
A classification model can produce false positives and misses, especially on files that differ from its training data. Results should be assessed alongside independent security tools and contextual investigation. Public documentation and source code are available on GitHub.