Machine Learning-Based Malware Classification & APT Attribution

A threat intelligence project classifying malware samples by their associated Advanced Persistent Threat (APT) groups using opcode-based analysis. Workflow: Dataset Creation (extracted and cleaned opcode text from malware samples, mapped each to its corresponding APT group, building a structured dataset of file hashes, APT labels, and opcode text features); Feature Engineering (converted opcode sequences into numerical features using unigram and bigram representations); Model Training (trained and compared multiple classifiers -- Support Vector Machine, K-Nearest Neighbours, and Decision Tree); Evaluation (assessed performance using accuracy, precision, recall, F1-score, and confusion matrices); and a Threat Intelligence Focus exploring how malware behaviour patterns can support attribution and help analysts connect samples to known adversary groups.

Tools: Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Decision Tree

Skills demonstrated: cyber threat intelligence (CTI), malware analysis, opcode-based feature engineering, APT attribution, classifier evaluation methodology

Outcome: Reinforced the applied value of machine learning in cyber threat intelligence -- malware triage, pattern recognition, and early-stage attribution support.