Bridging Theory and Practice: A Hybrid Malware Detection System with 3D Propagation Visualization for Cybersecurity Training

Abstract

This study presents an innovative pedagogical approach to cybersecurity education through the development of an interactive malware propagation simulation. The system integrates a hybrid detection model, combining SHA-256 signature analysis, a proprietary heuristic engine, and file verification using the WinTrust API, in addition to system-level monitoring through Microsoft Defender’s command-line interface. Its main contribution lies in a dynamic visualization module that represents malware propagation in a virtual network of nodes, displaying states such as healthy, infected, or immune through color-coded graphics. This interactive component allows real-time observation and experimentation with infection dynamics, effectively bridging theory and practice. Tests demonstrated its ability to identify suspicious files and simulate various propagation scenarios, validating its potential as an educational resource in cybersecurity.