As attackers increasingly weaponize polymorphic, metamorphic, and obfuscated malware, traditional static and signature-based detection methods are no longer sufficient for developers building secure digital platforms—including Umbraco-based solutions. This session delivers a deep, developer-heavy technical walkthrough of a heuristic and machine-learning-driven malware detection framework engineered specifically for Windows environments.

Based on my postgraduate research, we’ll explore how to extract meaningful behavioral and structural indicators from Windows binaries using programmatic techniques such as entropy analysis, opcode pattern extraction, PE header inspection, DLL import analysis, API call sequence heuristics, and CFG profiling. We will then transform these indicators into feature vectors suitable for ML classifiers such as XGBoost, Random Forest, SVM, and ensemble models.

This session also demonstrates how to integrate this detection pipeline into modern .NET development workflows and Azure-based architectures, including:

automated feature extraction using Python/ML pipelines;

scoring malware samples in real time via Azure Machine Learning endpoints;

leveraging Event Tracing for Windows (ETW) to capture runtime behaviours;

feeding ML outputs into custom dashboards, security automations, or CI pipelines.

The talk includes a live demonstration of the detection engine analyzing real malware samples inside an isolated sandbox environment, showing developers exactly how heuristic patterns are generated, how ML models respond, and how detection results can be integrated into practical solutions.

Attendees will leave with a deep understanding of how to combine heuristics, behavioral analysis, and machine learning to build next-generation detection capabilities—knowledge directly applicable to building more secure applications, packages, and cloud workflows in the .NET and Umbraco ecosystems.