# Malware Feature Classifier

**Time:** 45–90 minutes | **Level:** Beginner

## What you will build
A local Streamlit dashboard that loads numeric security telemetry, trains or runs an educational anomaly model, shows interactive visualizations, and exports the sample data.

## Safety boundary
Static feature classification only. No executable malware, binary files or malware execution is included.
Use only included synthetic data or publicly licensed / explicitly authorized, sanitized features. Never test against live systems.

## Setup
```bash
cd cybersecurity_lab/02_malware_static
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
pip install -r requirements.txt
streamlit run app.py
```

## Guided exercise
1. Launch the app and inspect `sample_data.csv`. The `SYN-` prefix indicates generated records.
2. Observe the feature columns: `file_size_kb, entropy, import_count, section_count, suspicious_strings, unsigned_flag, packed_indicator`.
3. Review precision, recall, F1 and the held-out confusion matrix. Notice false positives and false negatives.
4. Change a copy of the CSV (not the original), reload and compare results.
5. Explain why performance on artificial data cannot establish real-world attack detection.
6. Propose a safer validation plan using public benchmarks, temporal splits and independent site data where permitted.

## Learning challenge
Compare the baseline with a logistic regression or gradient boosting model and report precision/recall.

## Dataset and deployment limitations
- Synthetic records were generated by simplified rules; easy patterns may cause artificially high metrics.
- This tutorial is not a security product, IDS, malware scanner or industrial control system monitor.
- Only numeric features are accepted; raw packet capture, executable files and device connections are not supported.
- Do not publish confidential plant information.

## Share your work
Contribute a reproducible, safe enhancement via AIMPACT's public contribution process after reviewing `DATA_POLICY.md`.