MalDataGen

MalDataGen is an advanced Python framework for generating and evaluating synthetic tabular datasets using modern generative models, including diffusion and adversarial architectures.

Generate Convert Improve

Install / Use

/learn @kayua/MalDataGen

About this skill

Quality Score

0/100

README

🌊 MalDataGen - v.1.0.0 (Jellyfish 🪼)

SynDataGen is an advanced Python framework for generating and evaluating synthetic tabular datasets using modern generative models, including diffusion and adversarial architectures. Designed for researchers and practitioners, it provides reproducible pipelines, fine-grained control over model configuration, and integrated evaluation metrics for realistic data synthesis.

Citation

If you use MalDataGen in your research, whether for generating synthetic data, reproducing results, or as part of your malware detection pipeline, please cite our paper:

@inproceedings{sbseg25_maldatagen,
 author = {Kayuã Paim and Angelo Nogueira and Diego Kreutz and Weverton Cordeiro and Rodrigo Mansilha},
 title = { MalDataGen: A Modular Framework for Synthetic Tabular Data Generation in Malware Detection},
 booktitle = {Companion Proceedings of the 25th Brazilian Symposium on Cybersecurity},
 location = {Foz do Iguaçu/PR},
 year = {2025},
 keywords = {},
 issn = {0000-0000},
 pages = {38--47},
 publisher = {SBC},
 address = {Porto Alegre, RS, Brasil},
 doi = {10.5753/sbseg_estendido.2025.12113},
 url = {https://sol.sbc.org.br/index.php/sbseg_estendido/article/view/36739}
}

📖 Overview <a name="overview"></a>

MalDataGen is a modular and extensible synthetic data generation library for tabular data for malware dectition. It aims to:

Support state-of-the-art generative models (GANs, VAEs, Diffusion, etc.)
Improve model generalization by augmenting training data
Enable fair benchmarking via reproducible evaluations (TS-TR and TR-TS)
Provide publication-ready metrics and visualizations

It supports GPU acceleration, CSV/XLS ingestion, custom CLI scripts, and integration with academic pipelines.

Model architecure overivew

WWe provide a visual overview of the internal architecture of each model's building blocks through five detailed figures, highlighting the main structural changes across the models. These diagrams are documented and explained in the Overview.md [Overview.md ] file.(https://github.com/SBSeg25/MalDataGen/blob/2dd9eaad74da7726c130e50dbc35f95a463cbd00/Docs/Overview.md)

📋 Architecture Documentation

We provide a comprehensive visual overview (8 diagrams) at Docs/Diagrams/ of the MalDataGen framework, covering its architecture, design principles, data processing flow, and evaluation strategies. Developed using Mermaid notation, these diagrams support understanding of both the structural and functional aspects of the system. They include high-level system architecture, object-oriented class relationships, evaluation workflows, training pipelines, metric frameworks, and data flow. Together, they offer a detailed and cohesive view of how MalDataGen enables the generation and assessment of synthetic data in cybersecurity contexts.

📖 Video <a name="Video"></a>

The following link showcases a video of a demonstration of the tool: https://drive.google.com/file/d/1sbPZ1x5Np6zolhFvCBWoMzqNqrthlUe3/view?usp=sharing

if that doesn't work we have a backup on: https://youtu.be/t-AZtsLJUlQ

🚀 Getting Started <a name="getting-started"></a>

Prerequisites

Python 3.10+
pip
(Optional) CUDA 11+ for GPU acceleration

Optional: Create a virtual environment

pip install virtualenv
python3 -m venv ~/Python3venv/MalDataGen
source ~/Python3venv/MalDataGen/bin/activate

⚙️ Installation <a name="installation"></a>

pip install maldatagen
# or
git clone https://github.com/SBSeg25/MalDataGen.git 
cd MalDataGen
pip install --upgrade pip
pip install -r requirements.txt

Security worries <a name="securty_worries"></a>

We declare that the local execution of experiments has no security worries, however the docker executing require sudo permissions being available to the docker engine.

🏆 Awards Received <a name="stamps"></a>

Highlighted Artifact
Awarded for outstanding contributions in the artifacts category.
Details at SBSEG 25

Best Tool of SBSEG 2025
Recognized as the most innovative and impactful tool at the symposium.
Official award document

🚀 Run Tests

Demo

In order to execute a demo of the tool, utilized the comand listed below. The execution of this reduced demo takes around 3 minutes on a AMD Ryzen 7 5800x, 8 cores, 64 GB RAM machine.

# Run the basic demo
python3 run_campaign_sbseg.py -c sf

Alternatively, you can use the a docker container to execute the demo, by using the following comand:

# Run the basic demo
./run_demo_docker.sh

Reproduction

In order to reproduce the results from the paper execute the comand below, the experiments take around 7 hours on a AMD Ryzen 7 5800x, 8 cores, 64 GB RAM machine.

# Run all experiments from the paper
python3 run_campaign_sbseg.py

Or to execute with docker:

# Run all experiments from the paper
./run_experiments_docker.sh

Expected outputs:

After executing the experiments, you should observe the following structure within the outputs folder, with a separate folder for each model executed: <img width="1600" height="507" alt="image" src="https://github.com/user-attachments/assets/fafb0516-c227-4aba-8596-679aeb1d68f9" /> A results folder is also present, containing the training curves for each model.

Within each model's folder, there will be five subfolders:

- Data generated: Contains the synthetic dataset and the partitioned subsets of the real dataset used for training.

- Evaluation results: Contains:

    - A clustering visualization of the dataset samples to assist in identifying malware families.

    - Heatmaps comparing the synthetic and real samples for each fold; these are intended to illustrate the variability of specific features, with a closer alignment indicating greater similarity.

    - Confusion matrices for each classifier on each fold.

    - A bar graph presenting the metrics for each classifier using the TSTR and TRTS evaluation methods.

- Logs: Contains the generated logs.

- Monitor: Contains the raw data collected during the monitoring of the experiment.

- Models Saved: Contains the saved models for each fold, provided the option to save models was active.

Additionally, a file named "Binary classification metrics for SVM classifier.pdf" should be created in the project's root folder. This file provides a comparison of the SVM classifier's performance across the models, similar to Figure 3 in the article.

🧠 Architectures Supported <a name="architectures"></a>

🔨 Native Models

| Model | Description | Use Case | |-----------------------|-----------------------------------------------------------------------------|---------------------------------------------| | CGAN | Conditional GANs conditioned on labels or attributes | Class balancing, controlled generation | | WGAN | Wasserstein GAN with Earth-Mover distance for improved stability | Imbalanced datasets, stable training | | WGAN-GP | Wasserstein GAN with gradient penalty for stable training | Imbalanced datasets, complex distributions | | Autoencoder | Latent-space learning through compression-reconstruction | Feature extraction, denoising | | VAE | Probabilistic Autoencoder with latent sampling | Probabilistic generation and imputation | | Denoising Diffusion | Progressive noise-based generative model | Robust generation with high-quality samples | | Latent Diffusion | Diffusion model operating in compressed latent space | High-resolution generation, efficiency | | VQ-VAE | Discrete latent-space via quantization | Categorical and mixed-type data | | SMOTE | Synthetic Minority Over-sampling Technique (interpola

Related Skills

node-connect

343.3k

Diagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps

frontend-design

92.1k

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.

openai-whisper-api

343.3k

Transcribe audio via OpenAI Audio Transcriptions API (Whisper).

qqbot-media

343.3k

QQBot 富媒体收发能力。使用 <qqmedia> 标签，系统根据文件扩展名自动识别类型（图片/语音/视频/文件）。