MALWARE DETECTION
FRAMEWORK.

A Django-powered machine-learning platform that detects potentially malicious Android applications through static feature analysis and multi-model classification.

Published in IEEE Access (February 2022). The framework is built around reverse-engineered Android applications and combines classical machine-learning classifiers with an ensemble voting strategy.

WHAT IT SOLVES.

The project addresses the need to classify Android applications as benign or malicious when source or reverse-engineered characteristics are available, without running the payload directly.

• Collects Android app metadata and textual features for classification.
• Trains multiple classifiers and selects an ensemble for prediction.
• Exposes prediction workflows through a web interface for review.
• Tracks accuracy, ratios, and predicted datasets through an admin workflow.

SYSTEM LAYERS.

The platform separates user-facing prediction flows from model training and reporting flows.

• Remote User: registration, login, app prediction submission, profile.
• Service Provider: model training, prediction ratio review, prediction type review, remote user management, dataset download.
• Infrastructure: Django views, scikit-learn pipeline, MySQL persistence, static templates and media.

TOOLS.

Production-style academic stack used across backend, data, and deployment tooling.

• Django 3.2 · Python · scikit-learn
• Pandas · NumPy · MySQL · PyMySQL · xlwt
• XAMPP · web framework internals · admin panel

HOW IT WORKS.

The ML pipeline vectorizes app text, splits data, trains classifiers, and stores outcomes.

• Dataset: Android_Apps_Datasets.csv with labels mapped to No Malware and Malware Detected.
• Vectorization: CountVectorizer with unigrams.
• Models: Naive Bayes, SVM LinearSVC, Logistic Regression, Decision Tree, Random Forest, SGD, and VotingClassifier ensemble.
• Training endpoint: /train_model/.
• Prediction endpoint: /Predict_Malware_Prediction/.
• Reporting: accuracy, confusion matrices, classification reports, ratios, prediction types, remote users, Excel export.

RUN.

Local workflow used during development and presentation, with a Render-ready production configuration.

• Start MySQL through XAMPP.
• Import Database/malware_detection.sql.
• Run migrations.
• Start server and open http://127.0.0.1:8000/.
• Deploy to Render using the repository blueprint with gunicorn and environment variables.

CURRENT STATE.

The platform is presented as an academic project with an admin and analyst workflow around prediction quality. The repository is prepared as Render-ready for deployment using gunicorn and environment-based configuration.