# ragulmanday/malware-detector architecture

> Architecture diagram of the GitHub repository ragulmanday/malware-detector, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ragulmanday/malware-detector
- Repository: https://github.com/ragulmanday/malware-detector

## Overview

Malware Detector is a Streamlit application that analyzes uploaded Windows executables and DLLs, alongside scripts for training and evaluating its classifier. In the runtime workflow, the app extracts EMBER features, normalizes them, runs a feedforward network, and presents a verdict; it supports both single-file and batch uploads. Training prepares labeled EMBER data, fits the scaler and network, and saves artifacts used by the app. Evaluation reuses training data preparation and reports classification metrics. Training-data wiring is based on the README; unsampled modules are not mapped in detail.

Main entry points: [`app.py`](https://github.com/ragulmanday/malware-detector/blob/main/app.py) (Streamlit App), [`src/train.py`](https://github.com/ragulmanday/malware-detector/blob/main/src/train.py) (Training Pipeline), [`src/evaluate.py`](https://github.com/ragulmanday/malware-detector/blob/main/src/evaluate.py) (Model Evaluation), [`src/model.py`](https://github.com/ragulmanday/malware-detector/blob/main/src/model.py) (Neural Network)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Detection Runtime"]
  node_app["Streamlit App<br/>[app.py]"]
end

subgraph group_features["PE Features"]
  node_extractor["EMBER Extractor<br/>[features.py]"]
end

subgraph group_modeling["Model Lifecycle"]
  node_network["Neural Network<br/>[model.py]"]
  node_training["Training Pipeline<br/>[train.py]"]
  node_evaluation["Model Evaluation<br/>[evaluate.py]"]
end

subgraph group_artifacts["Saved Artifacts"]
  node_scaler["Fitted Scaler<br/>[scaler.pkl]"]
  node_weights["Model Weights<br/>[malware_model.pth]"]
end

node_user(("File Uploader"))
node_dataset[("EMBER Dataset")]

node_user -->|"uploads files"| node_app
node_app -->|"extracts features"| node_extractor
node_app -->|"loads scaler"| node_scaler
node_app -->|"runs inference"| node_network
node_app -->|"loads weights"| node_weights
node_app -->|"shows verdict"| node_user
node_dataset -->|"supplies data"| node_training
node_training -->|"trains network"| node_network
node_training -->|"saves scaler"| node_scaler
node_training -->|"saves weights"| node_weights
node_evaluation -->|"reuses preparation"| node_training
node_evaluation -->|"evaluates network"| node_network
node_evaluation -->|"loads weights"| node_weights

click node_app "https://github.com/ragulmanday/malware-detector/blob/main/app.py"
click node_extractor "https://github.com/ragulmanday/malware-detector/blob/main/ember_local/features.py"
click node_network "https://github.com/ragulmanday/malware-detector/blob/main/src/model.py"
click node_scaler "https://github.com/ragulmanday/malware-detector/blob/main/model/scaler.pkl"
click node_weights "https://github.com/ragulmanday/malware-detector/blob/main/model/malware_model.pth"
click node_training "https://github.com/ragulmanday/malware-detector/blob/main/src/train.py"
click node_evaluation "https://github.com/ragulmanday/malware-detector/blob/main/src/evaluate.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app toneBlue
class node_extractor,node_dataset toneAmber
class node_network,node_training,node_evaluation toneMint
class node_scaler,node_weights toneRose
class node_user toneIndigo
```

## Components

### Detection Runtime

- [Streamlit App](https://github.com/ragulmanday/malware-detector/blob/main/app.py): `app.py`

### PE Features

- [EMBER Extractor](https://github.com/ragulmanday/malware-detector/blob/main/ember_local/features.py): `ember_local/features.py`

### Model Lifecycle

- [Neural Network](https://github.com/ragulmanday/malware-detector/blob/main/src/model.py): `src/model.py`
- [Training Pipeline](https://github.com/ragulmanday/malware-detector/blob/main/src/train.py): `src/train.py`
- [Model Evaluation](https://github.com/ragulmanday/malware-detector/blob/main/src/evaluate.py): `src/evaluate.py`

### Saved Artifacts

- [Fitted Scaler](https://github.com/ragulmanday/malware-detector/blob/main/model/scaler.pkl): `model/scaler.pkl`
- [Model Weights](https://github.com/ragulmanday/malware-detector/blob/main/model/malware_model.pth): `model/malware_model.pth`

### Other components

- **File Uploader**
- **EMBER Dataset**

## Connections

- File Uploader → Streamlit App: uploads files (evidence: `README.md`)
- Streamlit App → EMBER Extractor: extracts features (evidence: `app.py`)
- Streamlit App → Fitted Scaler: loads scaler (evidence: `app.py`)
- Streamlit App → Neural Network: runs inference (evidence: `app.py`)
- Streamlit App → Model Weights: loads weights (evidence: `app.py`)
- Streamlit App → File Uploader: shows verdict (evidence: `app.py`)
- EMBER Dataset → Training Pipeline: supplies data (evidence: `README.md`)
- Training Pipeline → Neural Network: trains network (evidence: `src/train.py`)
- Training Pipeline → Fitted Scaler: saves scaler (evidence: `src/train.py`)
- Training Pipeline → Model Weights: saves weights (evidence: `src/train.py`)
- Model Evaluation → Training Pipeline: reuses preparation (evidence: `src/evaluate.py`)
- Model Evaluation → Neural Network: evaluates network (evidence: `src/evaluate.py`)
- Model Evaluation → Model Weights: loads weights (evidence: `src/evaluate.py`)