Instructions to use canalan/MalwareDatasetClassification with libraries, inference providers, notebooks, and local apps. Follow these links to get started.
- Libraries
- Scikit-learn
How to use canalan/MalwareDatasetClassification with Scikit-learn:
from huggingface_hub import hf_hub_download import joblib model = joblib.load( hf_hub_download("canalan/MalwareDatasetClassification", "sklearn_model.joblib") ) # only load pickle files from sources you trust # read more about it here https://skops.readthedocs.io/en/stable/persistence.html - Notebooks
- Google Colab
- Kaggle
docs: relative link to README.tr.md
Browse files
README.md
CHANGED
|
@@ -130,6 +130,44 @@ Bundle keys: `representation_order`, `representation_columns`, `numeric_feature_
|
|
| 130 |
|
| 131 |
Training details and ablations: **`svc_sban.ipynb`**.
|
| 132 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 133 |
### Split sizes used in training notebook
|
| 134 |
|
| 135 |
| Split | Rows | bodmas | dike | malwarebazaar | sorel20m |
|
|
|
|
| 130 |
|
| 131 |
Training details and ablations: **`svc_sban.ipynb`**.
|
| 132 |
|
| 133 |
+
### Feature pruning (TF-IDF columns)
|
| 134 |
+
|
| 135 |
+
Implemented in **`svc_sban.ipynb`** (cells after the first per-representation `LinearSVC` bases):
|
| 136 |
+
|
| 137 |
+
1. **Importance** — For each representation, mean `|coef_|` over classes from `final_base_models` (TF-IDF tokens + six numeric stats).
|
| 138 |
+
2. **Sort ascending** — Lowest-importance names are dropped first.
|
| 139 |
+
3. **Ratio sweep** — Validation macro-F1 was plotted for many removal ratios (roughly **5–60%** and **65–80%** in the analysis figures); the exported model uses a single setting.
|
| 140 |
+
4. **Production choice** — **`feature_pruning_ratio = 0.65`**: remove the lowest **65%** of the ranked feature list for TF-IDF vocabulary entries. The six numeric columns (`char_count`, `line_count`, `token_count`, `avg_line_length`, `unique_token_ratio`, `char_entropy`) are **always kept** and re-appended via fixed column indices after TF-IDF subsetting.
|
| 141 |
+
|
| 142 |
+
Validation macro-F1 at **65%** feature removal (same notebook run):
|
| 143 |
+
|
| 144 |
+
| Representation | Macro F1 (val) | Columns after prune |
|
| 145 |
+
|----------------|----------------|---------------------|
|
| 146 |
+
| asm | 0.7009 | 26,259 |
|
| 147 |
+
| binary | 0.6609 | 26,259 |
|
| 148 |
+
| nld | 0.4870 | 26,259 |
|
| 149 |
+
| source | 0.8802 | 26,257 |
|
| 150 |
+
|
| 151 |
+
These pruned column sets are stored in the joblib bundle as `representations[r]["selected_indices"]` (feature step only; ID pruning below may reuse the same index vector).
|
| 152 |
+
|
| 153 |
+
### ID pruning (training samples)
|
| 154 |
+
|
| 155 |
+
Overlapping **bodmas** vs **sorel20m** IDs motivate dropping ambiguous training rows before refitting bases:
|
| 156 |
+
|
| 157 |
+
1. Fix **feature pruning at 65%** and fit a temporary `LinearSVC` on pruned features.
|
| 158 |
+
2. **Score** each training row in **`bodmas`** and **`sorel20m`** only: sparse TF-IDF presence (binary) dotted with pruned-model TF-IDF coefficient magnitudes → `importance_score`.
|
| 159 |
+
3. **Grid** — For each representation, remove the lowest-scoring **`id_prune_ratios`** fraction **per class** (5%, 10%, …, 70%), refit on remaining train rows, measure validation macro-F1 → `id_pruning_summary` in the notebook.
|
| 160 |
+
4. **Production choice** — `selected_id_prune_ratios`:
|
| 161 |
+
|
| 162 |
+
| Representation | ID remove ratio | Val macro F1 | Train rows kept | Removed bodmas / sorel20m |
|
| 163 |
+
|----------------|-----------------|--------------|-----------------|---------------------------|
|
| 164 |
+
| asm | **10%** | 0.6978 | 102,538 | 5,689 / 4,941 |
|
| 165 |
+
| binary | **5%** | 0.6625 | 107,854 | 2,844 / 2,470 |
|
| 166 |
+
| source | **40%** | 0.8712 | 70,646 | 22,756 / 19,766 |
|
| 167 |
+
| nld | **40%** | 0.4804 | 70,646 | 22,756 / 19,766 |
|
| 168 |
+
|
| 169 |
+
Final stacking retrains ID-pruned bases (5-fold OOF decision scores), then class-weight search and meta learner on top of that pipeline. **`dike`** and **`malwarebazaar`** rows are never removed by this step.
|
| 170 |
+
|
| 171 |
### Split sizes used in training notebook
|
| 172 |
|
| 173 |
| Split | Rows | bodmas | dike | malwarebazaar | sorel20m |
|