Features are only half the pipeline; the other half is choosing how a production malware classifier is actually structured and kept current.
- Extract static features (imported APIs, entropy, header fields, string artefacts) from every new file submitted for scanning.
- Optionally extract dynamic features from a sandboxed execution, system calls made, files written, network connections attempted, when static analysis alone is inconclusive.
- Score the combined feature vector with a trained classifier (Unit 2's random forest or gradient boosting are the usual default choices for this exact task).
- Route low-confidence predictions to a human analyst rather than forcing an automatic verdict; Unit 6's precision-recall discussion explains precisely why this threshold matters.
- Retrain regularly on newly confirmed samples, since malware families evolve and a static model's accuracy decays over time, the same point Unit 1's pipeline diagram made with its loop back to feature engineering.
Case study: Two Malware Families That Changed How Defenders Think
WannaCry (May 2017) spread using the leaked EternalBlue exploit against an unpatched Windows SMB vulnerability, infecting an estimated 200,000 computers across roughly 150 countries within days, including substantial disruption to the UK's National Health Service. Its rapid, automated, wormlike spread, no phishing click required, pushed the industry toward behavioural and network-anomaly detection (Unit 3) specifically because a purely file-based, static signature response was too slow for a worm propagating this fast.
Mirai (first identified in 2016) infected poorly secured Internet of Things devices, routers, cameras, DVRs, using a short list of default credentials, and its source code was later released publicly, after which it was used to launch one of the largest distributed denial-of-service attacks recorded at the time, against the DNS provider Dyn in October 2016, disrupting major internet services across the United States. Mirai's lesson for this course is specifically about features: traditional file-based malware features barely apply to it at all, since its payload is trivial; detecting it requires the network-traffic features from the previous topic, unusual outbound scanning on IoT-typical ports.
Key takeaway
WannaCry and Mirai teach opposite halves of the same lesson. A worm that spreads too fast for signatures needs behavioural detection. A device with a trivial payload and no interesting file to analyse needs network-traffic features instead. Neither case is solved by a better classifier alone; both are solved by choosing the right features for what the threat actually looks like.