How raahulpatel07/malwaredetection works
This is a Windows-focused malware detection application. Its main workflow is file arrival or modification → filtering and static analysis → calibrated ML detection for PE files (with heuristic scoring for other types) → verdict, quarantine when suspicious or malicious, notification, and scan-history logging. The Flask dashboard provides manual scans and scan/quarantine history and actions; model training and calibration support the detection layer. Some monitor and dashboard wiring is inferred from the README because the relevant source excerpts are incomplete.
Main entry points: realtime_monitor.py Realtime Monitor · app.py Dashboard API · hybrid_model.py Hybrid Ensemble · train_hybrid.py Model Training
Components 19
Monitoring and Scanning
- Realtime Monitor
src/realtime_monitor.py
Detection Engine
- Static Analyzer
src/file_analyzer.py - ML Detector
src/ml_detector.py - Hybrid Ensemble
src/hybrid_model.py - Model and Calibration
model/hybrid_calibration.json
Response and Records
- Quarantine Manager
src/quarantine.py - Desktop Notifications
- Scan History
src/config.py - Restore Exemptions
src/restore_exclusions.py
Dashboard
- Dashboard API
dashboard/app.py - Dashboard UI
dashboard/templates - Dashboard Actions
dashboard/static/js/script.js
Model Preparation
- Model Training
src/train_hybrid.py - Model Calibration
src/calibrate_hybrid.py
Other components
- User
- Watched Files
- Dashboard User
- EMBER Dataset
- Trained Model
model
Connections 23
- Watched Files → Realtime Monitor: trigger events
- Realtime Monitor → Static Analyzer: analyze files
- Realtime Monitor → ML Detector: score PE files
- ML Detector → Hybrid Ensemble: score features
- ML Detector → Model and Calibration: read calibration
- Hybrid Ensemble → Model and Calibration: load model
- Realtime Monitor → Quarantine Manager: quarantine flagged
- Realtime Monitor → Scan History: write scan results
- Realtime Monitor → Desktop Notifications: notify verdict
- Realtime Monitor → Restore Exemptions: check exemptions
- Dashboard User → Dashboard UI: use dashboard
- Dashboard UI → Dashboard Actions: load actions
- Dashboard Actions → Dashboard API: request actions
- Dashboard API → Scan History: read and write
- Dashboard API → Quarantine Manager: manage files
- Dashboard API → Restore Exemptions: record restore
- Dashboard API → Static Analyzer: run manual scan
- Model Training → EMBER Dataset: read samples
- Model Training → Hybrid Ensemble: fit model
- Model Training → Trained Model: save model
- Model Calibration → EMBER Dataset: read samples
- Model Calibration → Hybrid Ensemble: score samples
- Model Calibration → Model and Calibration: write calibration