Skip to content

Commit

Permalink
Deprecated avclass, renamed avclass2 to avclass, prepared package
Browse files Browse the repository at this point in the history
  • Loading branch information
malicialab committed Feb 22, 2023
1 parent a17a0e5 commit eddbc2b
Show file tree
Hide file tree
Showing 25 changed files with 642 additions and 2,861 deletions.
133 changes: 132 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
@@ -1 +1,132 @@
*.pyc
# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class

# C extensions
*.so

# Distribution / packaging
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
pip-wheel-metadata/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST

# PyInstaller
# Usually these files are written by a python script from a template
# before PyInstaller builds the exe, so as to inject date/other infos into it.
*.manifest
*.spec

# Installer logs
pip-log.txt
pip-delete-this-directory.txt

# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
*.py,cover
.hypothesis/
.pytest_cache/

# Translations
*.mo
*.pot

# Django stuff:
*.log
local_settings.py
db.sqlite3
db.sqlite3-journal

# Flask stuff:
instance/
.webassets-cache

# Scrapy stuff:
.scrapy

# Sphinx documentation
docs/_build/

# PyBuilder
target/

# Jupyter Notebook
.ipynb_checkpoints

# IPython
profile_default/
ipython_config.py

# pyenv
.python-version

# pipenv
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
# However, in case of collaboration, if having platform-specific dependencies or dependencies
# having no cross-platform support, pipenv may install dependencies that don't work, or not
# install all needed dependencies.
#Pipfile.lock

# PEP 582; used by e.g. github.com/David-OConnor/pyflow
__pypackages__/

# Celery stuff
celerybeat-schedule
celerybeat.pid

# SageMath parsed files
*.sage.py

# Environments
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/

# Spyder project settings
.spyderproject
.spyproject

# Rope project settings
.ropeproject

# mkdocs documentation
/site

# mypy
.mypy_cache/
.dmypy.json
dmypy.json

# Pyre type checker
.pyre/

# TODO
TODO*
10 changes: 10 additions & 0 deletions EVALUATION.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,16 @@ This page is a work in progress to explain common errors that we
have observed, so that they can be avoided.
We'll try to update this page as we observe new issues.

Here is the quick summary if you are in a hurry:

1. AVClass2 has superseeded AVClass, so your evaluation should include AVClass2, not only the original AVClass.
2. For malware labeling, please use AVClass2 compatibility mode (-c command line option).
3. Tagging more samples is not an evaluation goal by itself, the tags need to be accurate. For example, it is known that allowing tags from a single AV engine or ignoring generic tags will enable tagging more samples, but it will introduce incorrect tags.
4. You need ground truth to evaluate the accuracy/precision/recall of AVClass/AVClass2.
5. You should also evaluate scalability (runtime and memory usage) since that is a major design goal of AVClass/AVClass2
6. Note that AVClass2 and AVClass may not provide the same family tag for all samples when run on the same AV labels.
7. AVClass2/AVClass are not malware detection tools, please do not try to evaluate them for that scenario.

## Which tool should I evaluate and compare with?

You should evaluate and compare with AVClass2.
Expand Down
1 change: 1 addition & 0 deletions MANIFEST.in
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
include avclass2/data/*
Loading

0 comments on commit eddbc2b

Please sign in to comment.