# arosenmund/all-about-info-stealers-analysis-coding architecture

> Architecture diagram of the GitHub repository arosenmund/all-about-info-stealers-analysis-coding, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/arosenmund/all-about-info-stealers-analysis-coding
- Repository: https://github.com/arosenmund/all-about-info-stealers-analysis-coding

## Overview

This repository is a supervised malware-analysis workshop, with a Go proof-of-concept exercise and a separate Python local-classification pipeline. The intended path is controlled corpus collection, safe preprocessing and evaluation, then relevance scoring and policy/reporting; workshop materials also cover reverse engineering. The graph includes documented and indexed modules, but many model stages were not sampled, so their internal connections are left unverified rather than inferred.

Main entry points: [`caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py`](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py) (Byte CNN), [`caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py`](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py) (Crawl orchestration), [`caito/python/phase_01_baseline/ngram_logistic.py`](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/phase_01_baseline/ngram_logistic.py) (N-gram baseline), [`caito/python/hybrid_edge_classifier/stage_08_fusion/calibrated.py`](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_08_fusion/calibrated.py) (Score fusion)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_workshop["Workshop exercises"]
  node_reverse["Malware analysis"]
  node_agent["Go agent<br/>[agent.go]"]
  node_server["Go server<br/>[server.go]"]
end

subgraph group_ingest["Corpus preparation"]
  node_authorization["Input contracts<br/>[contracts.py]"]
  node_crawl["Filesystem crawl<br/>[crawl.py]"]
  node_ingest["Corpus preprocessing"]
  node_canonical["Canonical records<br/>[canonical.py]"]
  node_classifierinputs["Classifier inputs"]
  node_duplicates["Duplicate analysis<br/>[duplicates.py]"]
  node_splits["Leakage-safe splits<br/>[splits.py]"]
  node_orchestration["Crawl orchestration<br/>[crawl_runner.py]"]
end

subgraph group_models["Scoring approaches"]
  node_features["Deterministic features<br/>[deterministic.py]"]
  node_baseline["N-gram baseline<br/>[ngram_logistic.py]"]
  node_cnn["Byte CNN<br/>[fp32.py]"]
  node_cnnexport["CNN export<br/>[onnx_export.py]"]
  node_quantization["CNN quantization<br/>[quantization.py]"]
  node_embedding["Static embedding<br/>[static_encoder.py]"]
  node_prototypes["Prototype matrix<br/>[matrix.py]"]
  node_retrieval["Top-k retrieval<br/>[exact_top_k.py]"]
  node_fusion["Score fusion<br/>[calibrated.py]"]
end

subgraph group_evaluation["Evaluation and decisions"]
  node_policy["Abstention policy<br/>[abstention.py]"]
  node_reporting["Redacted reporting<br/>[redacted.py]"]
  node_calibration["Calibration evaluation<br/>[calibration.py]"]
end

node_participant(("Workshop participant"))

node_participant -->|"analyzes"| node_reverse
node_participant -->|"builds PoC"| node_agent
node_participant -->|"explores scoring"| node_crawl
node_canonical -->|"validates with"| node_authorization
node_classifierinputs -->|"preprocesses via"| node_canonical
node_orchestration -->|"invokes"| node_crawl
node_orchestration -->|"invokes"| node_ingest
node_orchestration -->|"invokes"| node_features
node_baseline -->|"checks contract"| node_authorization
node_baseline -->|"uses inputs"| node_ingest
node_calibration -->|"consumes probabilities"| node_baseline
node_cnn -->|"checks contract"| node_authorization
node_cnn -->|"uses prepared inputs"| node_ingest
node_cnnexport -->|"exports model"| node_cnn
node_quantization -->|"quantizes export"| node_cnnexport
node_agent -.->|"communicates with"| node_server
node_embedding -.->|"feeds"| node_prototypes
node_prototypes -.->|"supports"| node_retrieval
node_retrieval -.->|"feeds scores"| node_fusion
node_features -.->|"contributes scores"| node_fusion
node_fusion -.->|"supplies scores"| node_policy
node_policy -.->|"provides decisions"| node_reporting
node_cnn -.->|"evaluated by"| node_calibration

click node_agent "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/05-writing-an-infostealer/nikito/agent/agent.go"
click node_server "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/05-writing-an-infostealer/nikito/server/server.go"
click node_authorization "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_00_authorization/contracts.py"
click node_crawl "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_01_filesystem_crawl/crawl.py"
click node_ingest "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/tree/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess"
click node_canonical "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/canonical.py"
click node_classifierinputs "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/classifier_input.py"
click node_duplicates "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/duplicates.py"
click node_splits "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/splits.py"
click node_features "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_03_features/deterministic.py"
click node_baseline "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/phase_01_baseline/ngram_logistic.py"
click node_cnn "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py"
click node_cnnexport "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_04_cnn/onnx_export.py"
click node_quantization "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_04_cnn/quantization.py"
click node_embedding "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_05_embedding/static_encoder.py"
click node_prototypes "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_06_prototypes/matrix.py"
click node_retrieval "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_07_retrieval/exact_top_k.py"
click node_fusion "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_08_fusion/calibrated.py"
click node_policy "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_09_policy/abstention.py"
click node_reporting "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_10_reporting/redacted.py"
click node_calibration "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/phase_01_evaluation/calibration.py"
click node_orchestration "https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_reverse,node_agent,node_server toneBlue
class node_authorization,node_crawl,node_ingest,node_canonical,node_classifierinputs,node_duplicates,node_splits,node_orchestration toneAmber
class node_features,node_baseline,node_cnn,node_cnnexport,node_quantization,node_embedding,node_prototypes,node_retrieval,node_fusion toneMint
class node_policy,node_reporting,node_calibration toneRose
class node_participant toneIndigo
```

## Components

### Workshop exercises

- **Malware analysis**
- [Go agent](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/05-writing-an-infostealer/nikito/agent/agent.go): `05-writing-an-infostealer/nikito/agent/agent.go`
- [Go server](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/05-writing-an-infostealer/nikito/server/server.go): `05-writing-an-infostealer/nikito/server/server.go`

### Corpus preparation

- [Input contracts](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_00_authorization/contracts.py): `caito/python/hybrid_edge_classifier/stage_00_authorization/contracts.py`
- [Filesystem crawl](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_01_filesystem_crawl/crawl.py): `caito/python/hybrid_edge_classifier/stage_01_filesystem_crawl/crawl.py`
- [Corpus preprocessing](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/tree/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess): `caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess`
- [Canonical records](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/canonical.py): `caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/canonical.py`
- [Classifier inputs](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/classifier_input.py): `caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/classifier_input.py`
- [Duplicate analysis](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/duplicates.py): `caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/duplicates.py`
- [Leakage-safe splits](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/splits.py): `caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/splits.py`
- [Crawl orchestration](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py): `caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py`

### Scoring approaches

- [Deterministic features](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_03_features/deterministic.py): `caito/python/hybrid_edge_classifier/stage_03_features/deterministic.py`
- [N-gram baseline](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/phase_01_baseline/ngram_logistic.py): `caito/python/phase_01_baseline/ngram_logistic.py`
- [Byte CNN](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py): `caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py`
- [CNN export](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_04_cnn/onnx_export.py): `caito/python/hybrid_edge_classifier/stage_04_cnn/onnx_export.py`
- [CNN quantization](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_04_cnn/quantization.py): `caito/python/hybrid_edge_classifier/stage_04_cnn/quantization.py`
- [Static embedding](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_05_embedding/static_encoder.py): `caito/python/hybrid_edge_classifier/stage_05_embedding/static_encoder.py`
- [Prototype matrix](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_06_prototypes/matrix.py): `caito/python/hybrid_edge_classifier/stage_06_prototypes/matrix.py`
- [Top-k retrieval](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_07_retrieval/exact_top_k.py): `caito/python/hybrid_edge_classifier/stage_07_retrieval/exact_top_k.py`
- [Score fusion](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_08_fusion/calibrated.py): `caito/python/hybrid_edge_classifier/stage_08_fusion/calibrated.py`

### Evaluation and decisions

- [Abstention policy](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_09_policy/abstention.py): `caito/python/hybrid_edge_classifier/stage_09_policy/abstention.py`
- [Redacted reporting](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/hybrid_edge_classifier/stage_10_reporting/redacted.py): `caito/python/hybrid_edge_classifier/stage_10_reporting/redacted.py`
- [Calibration evaluation](https://github.com/arosenmund/all-about-info-stealers-analysis-coding/blob/main/caito/python/phase_01_evaluation/calibration.py): `caito/python/phase_01_evaluation/calibration.py`

### Other components

- **Workshop participant**

## Connections

- Workshop participant → Malware analysis: analyzes (evidence: `README.md`)
- Workshop participant → Go agent: builds PoC (evidence: `README.md`)
- Workshop participant → Filesystem crawl: explores scoring (evidence: `README.md`)
- Canonical records → Input contracts: validates with (evidence: `caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/canonical.py`)
- Classifier inputs → Canonical records: preprocesses via (evidence: `caito/python/hybrid_edge_classifier/stage_02_ingestion_preprocess/classifier_input.py`)
- Crawl orchestration → Filesystem crawl: invokes (evidence: `caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py`)
- Crawl orchestration → Corpus preprocessing: invokes (evidence: `caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py`)
- Crawl orchestration → Deterministic features: invokes (evidence: `caito/python/hybrid_edge_classifier/stage_90_orchestration/crawl_runner.py`)
- N-gram baseline → Input contracts: checks contract (evidence: `caito/python/phase_01_baseline/ngram_logistic.py`)
- N-gram baseline → Corpus preprocessing: uses inputs (evidence: `caito/python/phase_01_baseline/ngram_logistic.py`)
- Calibration evaluation → N-gram baseline: consumes probabilities (evidence: `caito/python/phase_01_evaluation/calibration.py`)
- Byte CNN → Input contracts: checks contract (evidence: `caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py`)
- Byte CNN → Corpus preprocessing: uses prepared inputs (evidence: `caito/python/hybrid_edge_classifier/stage_04_cnn/fp32.py`)
- CNN export → Byte CNN: exports model (evidence: `caito/python/hybrid_edge_classifier/stage_04_cnn/onnx_export.py`)
- CNN quantization → CNN export: quantizes export (evidence: `caito/python/hybrid_edge_classifier/stage_04_cnn/quantization.py`)
- Go agent → Go server: communicates with
- Static embedding → Prototype matrix: feeds
- Prototype matrix → Top-k retrieval: supports
- Top-k retrieval → Score fusion: feeds scores
- Deterministic features → Score fusion: contributes scores
- Score fusion → Abstention policy: supplies scores
- Abstention policy → Redacted reporting: provides decisions
- Byte CNN → Calibration evaluation: evaluated by