# 87owo/pyas architecture

> Architecture diagram of the GitHub repository 87owo/pyas, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/87owo/pyas
- Repository: https://github.com/87owo/pyas

## Overview

PYAS is a Windows endpoint security application: users initiate scans or manage protection through its desktop interface, and the app coordinates local detection, optional cloud analysis, and response. Its documented detection stages include policy checks, metadata and hashing, signature verification, YARA, PE/ML classification, verdict aggregation, and remediation. Real-time user-mode monitoring and a kernel driver provide a separate protection branch. The README documents additional tools and online analysis; sampled source excerpts are partial, so uncertain internal call wiring is omitted.

Main entry points: [`PYAS_Engine.py`](https://github.com/87owo/pyas/blob/main/PYAS_Engine.py) (Detection engine), [`PYAS.py`](https://github.com/87owo/pyas/blob/main/PYAS.py) (App orchestration), [`PYAS_Scanner.py`](https://github.com/87owo/pyas/blob/main/PYAS_Scanner.py) (Scan scheduling), [`Interface/templates/index.html`](https://github.com/87owo/pyas/blob/main/Interface/templates/index.html) (WebView interface)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_app["Desktop application"]
  node_ui["WebView interface<br/>[index.html]"]
  node_frontend["UI interactions<br/>[main.js]"]
  node_appcore["App orchestration<br/>[PYAS.py]"]
  node_tools["System utilities<br/>[PYAS_Tools.py]"]
end

subgraph group_detection["Detection pipeline"]
  node_scanner["Scan scheduling<br/>[PYAS_Scanner.py]"]
  node_engine["Detection engine<br/>[PYAS_Engine.py]"]
  node_rules["YARA signatures"]
  node_pefeatures["PE feature extraction<br/>[scanner.py]"]
  node_model["ONNX inference<br/>[predict_onnx.py]"]
  node_response["Scan response<br/>[PYAS_Scanner.py]"]
  node_cloudclient["Cloud analysis client<br/>[PYAS_Engine.py]"]
end

subgraph group_protection["Endpoint protection"]
  node_protect["Live protection<br/>[PYAS_Protect.py]"]
  node_driver["Kernel filter<br/>[DriverEntry.cpp]"]
  node_driverules["Driver rules<br/>[ProtectRules.cpp]"]
end

subgraph group_services["Cloud and research"]
  node_cloudservice["Online analysis<br/>[PYAS_Cloud.py]"]
  node_training["Model training<br/>[train_server.py]"]
end

node_user(("User"))

node_user -->|"uses"| node_ui
node_frontend -->|"invokes API"| node_appcore
node_ui -->|"loads"| node_frontend
node_appcore -->|"coordinates scans"| node_scanner
node_appcore -->|"coordinates protection"| node_protect
node_appcore -->|"exposes tools"| node_tools
node_scanner -->|"scans targets"| node_engine
node_engine -->|"matches rules"| node_rules
node_engine -->|"extracts features"| node_pefeatures
node_pefeatures -->|"provides features"| node_model
node_engine -->|"returns verdict"| node_response
node_scanner -->|"remediates findings"| node_response
node_protect -->|"communicates"| node_driver
node_driver -->|"evaluates rules"| node_driverules
node_engine -.->|"requests analysis"| node_cloudclient
node_cloudclient -.->|"submits samples"| node_cloudservice

click node_ui "https://github.com/87owo/pyas/blob/main/Interface/templates/index.html"
click node_frontend "https://github.com/87owo/pyas/blob/main/Interface/static/js/main.js"
click node_appcore "https://github.com/87owo/pyas/blob/main/PYAS.py"
click node_scanner "https://github.com/87owo/pyas/blob/main/PYAS_Scanner.py"
click node_engine "https://github.com/87owo/pyas/blob/main/PYAS_Engine.py"
click node_rules "https://github.com/87owo/pyas/tree/main/Engine/Heuristic"
click node_pefeatures "https://github.com/87owo/pyas/blob/main/Engine/Properties/scanner.py"
click node_model "https://github.com/87owo/pyas/blob/main/Engine/Properties/predict_onnx.py"
click node_response "https://github.com/87owo/pyas/blob/main/PYAS_Scanner.py"
click node_protect "https://github.com/87owo/pyas/blob/main/PYAS_Protect.py"
click node_driver "https://github.com/87owo/pyas/blob/main/Plugins/Filter/DriverEntry.cpp"
click node_driverules "https://github.com/87owo/pyas/blob/main/Plugins/Filter/ProtectRules.cpp"
click node_tools "https://github.com/87owo/pyas/blob/main/PYAS_Tools.py"
click node_cloudclient "https://github.com/87owo/pyas/blob/main/PYAS_Engine.py"
click node_cloudservice "https://github.com/87owo/pyas/blob/main/PYAS_Cloud.py"
click node_training "https://github.com/87owo/pyas/blob/main/Engine/Properties/train_server.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ui,node_frontend,node_appcore,node_tools,node_user toneBlue
class node_scanner,node_engine,node_rules,node_pefeatures,node_model,node_response,node_cloudclient toneAmber
class node_protect,node_driver,node_driverules toneMint
class node_cloudservice,node_training toneRose
```

## Components

### Desktop application

- [WebView interface](https://github.com/87owo/pyas/blob/main/Interface/templates/index.html): `Interface/templates/index.html`
- [UI interactions](https://github.com/87owo/pyas/blob/main/Interface/static/js/main.js): `Interface/static/js/main.js`
- [App orchestration](https://github.com/87owo/pyas/blob/main/PYAS.py): `PYAS.py`
- [System utilities](https://github.com/87owo/pyas/blob/main/PYAS_Tools.py): `PYAS_Tools.py`

### Detection pipeline

- [Scan scheduling](https://github.com/87owo/pyas/blob/main/PYAS_Scanner.py): `PYAS_Scanner.py`
- [Detection engine](https://github.com/87owo/pyas/blob/main/PYAS_Engine.py): `PYAS_Engine.py`
- [YARA signatures](https://github.com/87owo/pyas/tree/main/Engine/Heuristic): `Engine/Heuristic`
- [PE feature extraction](https://github.com/87owo/pyas/blob/main/Engine/Properties/scanner.py): `Engine/Properties/scanner.py`
- [ONNX inference](https://github.com/87owo/pyas/blob/main/Engine/Properties/predict_onnx.py): `Engine/Properties/predict_onnx.py`
- [Scan response](https://github.com/87owo/pyas/blob/main/PYAS_Scanner.py): `PYAS_Scanner.py`
- [Cloud analysis client](https://github.com/87owo/pyas/blob/main/PYAS_Engine.py): `PYAS_Engine.py`

### Endpoint protection

- [Live protection](https://github.com/87owo/pyas/blob/main/PYAS_Protect.py): `PYAS_Protect.py`
- [Kernel filter](https://github.com/87owo/pyas/blob/main/Plugins/Filter/DriverEntry.cpp): `Plugins/Filter/DriverEntry.cpp`
- [Driver rules](https://github.com/87owo/pyas/blob/main/Plugins/Filter/ProtectRules.cpp): `Plugins/Filter/ProtectRules.cpp`

### Cloud and research

- [Online analysis](https://github.com/87owo/pyas/blob/main/PYAS_Cloud.py): `PYAS_Cloud.py`
- [Model training](https://github.com/87owo/pyas/blob/main/Engine/Properties/train_server.py): `Engine/Properties/train_server.py`

### Other components

- **User**

## Connections

- User → WebView interface: uses
- UI interactions → App orchestration: invokes API
- WebView interface → UI interactions: loads
- App orchestration → Scan scheduling: coordinates scans
- App orchestration → Live protection: coordinates protection
- App orchestration → System utilities: exposes tools
- Scan scheduling → Detection engine: scans targets
- Detection engine → YARA signatures: matches rules
- Detection engine → PE feature extraction: extracts features
- PE feature extraction → ONNX inference: provides features
- Detection engine → Scan response: returns verdict
- Scan scheduling → Scan response: remediates findings
- Live protection → Kernel filter: communicates
- Kernel filter → Driver rules: evaluates rules
- Detection engine → Cloud analysis client: requests analysis
- Cloud analysis client → Online analysis: submits samples