# darama22/malware-research-hub architecture

> Architecture diagram of the GitHub repository darama22/malware-research-hub, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/darama22/malware-research-hub
- Repository: https://github.com/darama22/malware-research-hub

## Overview

Malware Research Hub is a local, bilingual forensic catalog and specimen browser. Researchers use the web UI to search and filter indexed specimen metadata, inspect family and timeline information, and open a specimen’s collection folder; the server exposes the catalog and resource capabilities. The indexer scans the collections tree to produce the search index. Separately, the MalwareBazaar downloader and collection integrator extend the corpus and reindex it. The README documents containment and additional catalog/resource features; app source was not included in the sampled files, so implementation details and uncertain wiring are omitted.

Main entry points: [`app/server.py`](https://github.com/darama22/malware-research-hub/blob/main/app/server.py) (Flask server), [`app/static/app.js`](https://github.com/darama22/malware-research-hub/blob/main/app/static/app.js) (Browser UI), [`app/indexer.py`](https://github.com/darama22/malware-research-hub/blob/main/app/indexer.py) (Catalog indexer), [`app/integrate_collections.py`](https://github.com/darama22/malware-research-hub/blob/main/app/integrate_collections.py) (Collection integrator)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["Web experience"]
  node_ui["Browser UI<br/>[app.js]"]
  node_i18n["ES/EN text<br/>[i18n.js]"]
  node_server["Flask server<br/>[server.py]"]
end

subgraph group_catalog["Catalog and indexing"]
  node_catalogue["Forensic catalog"]
  node_indexer["Catalog indexer<br/>[indexer.py]"]
  node_index["Search index"]
  node_resources["Research resources<br/>[server.py]"]
end

subgraph group_corpus["Specimen corpus"]
  node_collections["Specimen collections"]
end

subgraph group_ingest["Corpus ingestion"]
  node_downloader["MalwareBazaar fetch<br/>[mb_download.py]"]
  node_integrator["Collection integrator"]
end

node_researcher(("Researcher"))
node_malwarebazaar(("MalwareBazaar API"))

node_researcher -->|"uses"| node_ui
node_ui -->|"requests"| node_server
node_server -->|"returns results"| node_ui
node_ui -->|"loads language"| node_i18n
node_server -->|"serves catalog"| node_catalogue
node_server -->|"queries metadata"| node_index
node_server -->|"serves resources"| node_resources
node_indexer -->|"scans"| node_collections
node_indexer -->|"generates"| node_index
node_researcher -->|"opens folder"| node_server
node_downloader -->|"downloads by API"| node_malwarebazaar
node_integrator -->|"integrates and encrypts"| node_collections
node_integrator -->|"reindexes"| node_indexer

click node_ui "https://github.com/darama22/malware-research-hub/blob/main/app/static/app.js"
click node_i18n "https://github.com/darama22/malware-research-hub/blob/main/app/static/i18n.js"
click node_server "https://github.com/darama22/malware-research-hub/blob/main/app/server.py"
click node_indexer "https://github.com/darama22/malware-research-hub/blob/main/app/indexer.py"
click node_resources "https://github.com/darama22/malware-research-hub/blob/main/app/server.py"
click node_collections "https://github.com/darama22/malware-research-hub/tree/main/collections"
click node_downloader "https://github.com/darama22/malware-research-hub/blob/main/app/mb_download.py"
click node_integrator "https://github.com/darama22/malware-research-hub/blob/main/app/integrate_collections.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ui,node_i18n,node_server toneBlue
class node_catalogue,node_indexer,node_index,node_resources toneAmber
class node_collections,node_malwarebazaar toneMint
class node_downloader,node_integrator toneRose
class node_researcher toneIndigo
```

## Components

### Web experience

- [Browser UI](https://github.com/darama22/malware-research-hub/blob/main/app/static/app.js): `app/static/app.js`
- [ES/EN text](https://github.com/darama22/malware-research-hub/blob/main/app/static/i18n.js): `app/static/i18n.js`
- [Flask server](https://github.com/darama22/malware-research-hub/blob/main/app/server.py): `app/server.py`

### Catalog and indexing

- **Forensic catalog**
- [Catalog indexer](https://github.com/darama22/malware-research-hub/blob/main/app/indexer.py): `app/indexer.py`
- **Search index**
- [Research resources](https://github.com/darama22/malware-research-hub/blob/main/app/server.py): `app/server.py`

### Specimen corpus

- [Specimen collections](https://github.com/darama22/malware-research-hub/tree/main/collections): `collections`

### Corpus ingestion

- [MalwareBazaar fetch](https://github.com/darama22/malware-research-hub/blob/main/app/mb_download.py): `app/mb_download.py`
- [Collection integrator](https://github.com/darama22/malware-research-hub/blob/main/app/integrate_collections.py): `app/integrate_collections.py`

### Other components

- **Researcher**
- **MalwareBazaar API**

## Connections

- Researcher → Browser UI: uses
- Browser UI → Flask server: requests
- Flask server → Browser UI: returns results
- Browser UI → ES/EN text: loads language
- Flask server → Forensic catalog: serves catalog
- Flask server → Search index: queries metadata
- Flask server → Research resources: serves resources
- Catalog indexer → Specimen collections: scans
- Catalog indexer → Search index: generates
- Researcher → Flask server: opens folder
- MalwareBazaar fetch → MalwareBazaar API: downloads by API
- Collection integrator → Specimen collections: integrates and encrypts
- Collection integrator → Catalog indexer: reindexes