A comprehensive cross-platform malware detection and classification system built with Rust (frontend) and Python (backend) using deep learning techniques.
-
Static Feature Extraction
- Bytecode/hex dump analysis
- PE header information extraction
- Opcode sequence analysis
- Import/Export table analysis
- Section entropy calculation
-
Dynamic Feature Extraction (Optional)
- API/system call tracing
- Network activity monitoring
- Sandbox behavior logs
- Registry/file system changes
- CNN Models: Grayscale image representation for malware visualization
- RNN/LSTM Models: Sequential analysis of opcodes and API calls
- Transformer Models: Advanced pattern recognition and attention mechanisms
- Classical ML: SVM, Random Forest, Gradient Boosting for baseline comparison
- Binary Classification: Malware vs. Benign detection
- Multi-class Classification: Malware family identification
- Real-time Detection: Sub-second inference capability
- Adversarial Robustness: Handling obfuscated/packed malware
- Model Comparison Dashboard: Performance metrics across different architectures
- Explainable AI: Grad-CAM, SHAP, attention visualization
- Threat Intelligence Integration: VirusTotal API, custom IOC feeds
- Automated Retraining Pipeline: CI/CD for model updates
- Comprehensive Reporting: PDF/JSON reports with detailed analysis
┌─────────────────────────────────────────────────────────────────┐
│ Frontend (Rust) │
├─────────────────────────────────────────────────────────────────┤
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │
│ │ GUI Layer │ │ File Handler │ │ API Client │ │
│ │ (Tauri/egui) │ │ (tokio-fs) │ │ (reqwest) │ │
│ └─────────────────┘ └─────────────────┘ └─────────────────┘ │
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │
│ │ Real-time Mon. │ │ Report Gen. │ │ Settings Mgmt │ │
│ │ (sysinfo) │ │ (PDF/JSON) │ │ (config) │ │
│ └─────────────────┘ └─────────────────┘ └─────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
│
HTTP/WebSocket
│
┌─────────────────────────────────────────────────────────────────┐
│ Backend (Python) │
├─────────────────────────────────────────────────────────────────┤
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │
│ │ API Gateway │ │ Authentication │ │ Load Balancer │ │
│ │ (FastAPI) │ │ (JWT) │ │ (Nginx) │ │
│ └─────────────────┘ └─────────────────┘ └─────────────────┘ │
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │
│ │ ML Pipeline │ │ Feature Ext. │ │ Model Serve │ │
│ │ (TensorFlow/ │ │ (Static/ │ │ (TF Serving/ │ │
│ │ PyTorch) │ │ Dynamic) │ │ TorchServe) │ │
│ └─────────────────┘ └─────────────────┘ └─────────────────┘ │
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │
│ │ Database │ │ File Storage │ │ Cache Layer │ │
│ │ (PostgreSQL + │ │ (MinIO/S3) │ │ (Redis) │ │
│ │ InfluxDB) │ └─────────────────┘ └─────────────────┘ │
│ └─────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
│
Isolated Network Bridge
│
┌─────────────────────────────────────────────────────────────────┐
│ Sandboxed Analysis Layer │
├─────────────────────────────────────────────────────────────────┤
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │
│ │ Docker Sandbox │ │ VM Isolation │ │ Network Jail │ │
│ │ (gVisor) │ │ (QEMU/KVM) │ │ (iptables) │ │
│ └─────────────────┘ └─────────────────┘ └─────────────────┘ │
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │
│ │ Dynamic Analysis│ │ Behavior Mon. │ │ API Hooking │ │
│ │ (Cuckoo) │ │ (Sysmon) │ │ (Detours) │ │
│ └─────────────────┘ └─────────────────┘ └─────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
- GUI: Tauri + React/Vue or native egui
- HTTP: reqwest, tokio
- System: sysinfo, notify
- Serialization: serde
- Framework: FastAPI, Uvicorn
- ML: TensorFlow, PyTorch, Scikit-learn
- Feature Extraction: pefile, python-magic, capstone
- Database: PostgreSQL, Redis
- Tasks: Celery, RQ
- Containerization: Docker, Docker Compose
- Monitoring: Prometheus, Grafana
- CI/CD: GitHub Actions
MalAnalysis/
├── frontend/ # Rust application
├── backend/ # Python API server
├── ml_models/ # Model definitions and training
├── feature_extraction/ # Static/dynamic analysis tools
├── data/ # Datasets and samples
├── docker/ # Container configurations
├── scripts/ # Utility scripts
└── docs/ # Documentation
-
Clone and Setup
git clone <repository> cd MalAnalysis
-
Backend Setup
cd backend pip install -r requirements.txt python -m uvicorn main:app --reload -
Frontend Setup
cd frontend cargo run -
Docker Deployment
docker-compose up -d
| Model | Accuracy | F1-Score | Inference Time |
|---|---|---|---|
| CNN | 97.2% | 0.971 | 0.3s |
| LSTM | 95.8% | 0.955 | 0.5s |
| Transformer | 98.1% | 0.979 | 0.7s |
- Sandboxed analysis environment
- Encrypted file storage
- Secure API endpoints
- Audit logging
- Role-based access control
- Advanced obfuscation detection
- Cloud-native deployment
- Mobile platform support
- Federated learning capabilities
- YARA rule integration
Please read CONTRIBUTING.md for contribution guidelines.
This project is licensed under the MIT License - see LICENSE file.