How arosenmund/all-about-info-stealers-analysis-coding works
This repository is a supervised malware-analysis workshop, with a Go proof-of-concept exercise and a separate Python local-classification pipeline. The intended path is controlled corpus collection, safe preprocessing and evaluation, then relevance scoring and policy/reporting; workshop materials also cover reverse engineering. The graph includes documented and indexed modules, but many model stages were not sampled, so their internal connections are left unverified rather than inferred.
Main entry points: fp32.py Byte CNN · crawl_runner.py Crawl orchestration · ngram_logistic.py N-gram baseline · calibrated.py Score fusion
Components 24
Workshop exercises
Corpus preparation
- Input contracts
caito/python/hybrid_edge_classifier/stage_00_authorization/contracts.py - Filesystem crawl
caito/python/hybrid_edge_classifier/stage_01_filesystem_crawl/crawl.py - Corpus preprocessing
caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess - Canonical records
caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/canonical.py - Classifier inputs
caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/classifier_input.py - Duplicate analysis
caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/duplicates.py - Leakage-safe splits
caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/splits.py - Crawl orchestration
caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py
Scoring approaches
- Deterministic features
caito/python/hybrid_edge_classifier/stage_03_features/deterministic.py - N-gram baseline
caito/python/phase_01_baseline/ngram_logistic.py - Byte CNN
caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py - CNN export
caito/python/hybrid_edge_classifier/stage_04_cnn/onnx_export.py - CNN quantization
caito/python/hybrid_edge_classifier/stage_04_cnn/quantization.py - Static embedding
caito/python/hybrid_edge_classifier/stage_05_embedding/static_encoder.py - Prototype matrix
caito/python/hybrid_edge_classifier/stage_06_prototypes/matrix.py - Top-k retrieval
caito/python/hybrid_edge_classifier/stage_07_retrieval/exact_top_k.py - Score fusion
caito/python/hybrid_edge_classifier/stage_08_fusion/calibrated.py
Evaluation and decisions
- Abstention policy
caito/python/hybrid_edge_classifier/stage_09_policy/abstention.py - Redacted reporting
caito/python/hybrid_edge_classifier/stage_10_reporting/redacted.py - Calibration evaluation
caito/python/phase_01_evaluation/calibration.py
Other components
- Workshop participant
Connections 23
- Workshop participant → Malware analysis: analyzes
README.md - Workshop participant → Go agent: builds PoC
README.md - Workshop participant → Filesystem crawl: explores scoring
README.md - Canonical records → Input contracts: validates with
caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/canonical.py - Classifier inputs → Canonical records: preprocesses via
caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/classifier_input.py - Crawl orchestration → Filesystem crawl: invokes
caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py - Crawl orchestration → Corpus preprocessing: invokes
caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py - Crawl orchestration → Deterministic features: invokes
caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py - N-gram baseline → Input contracts: checks contract
caito/python/phase_01_baseline/ngram_logistic.py - N-gram baseline → Corpus preprocessing: uses inputs
caito/python/phase_01_baseline/ngram_logistic.py - Calibration evaluation → N-gram baseline: consumes probabilities
caito/python/phase_01_evaluation/calibration.py - Byte CNN → Input contracts: checks contract
caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py - Byte CNN → Corpus preprocessing: uses prepared inputs
caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py - CNN export → Byte CNN: exports model
caito/python/hybrid_edge_classifier/stage_04_cnn/onnx_export.py - CNN quantization → CNN export: quantizes export
caito/python/hybrid_edge_classifier/stage_04_cnn/quantization.py - Go agent → Go server: communicates with
- Static embedding → Prototype matrix: feeds
- Prototype matrix → Top-k retrieval: supports
- Top-k retrieval → Score fusion: feeds scores
- Deterministic features → Score fusion: contributes scores
- Score fusion → Abstention policy: supplies scores
- Abstention policy → Redacted reporting: provides decisions
- Byte CNN → Calibration evaluation: evaluated by