susanth1436/adaptive-telemetry-malware-analysis

How susanth1436/adaptive-telemetry-malware-analysis works

Adaptive Telemetry is a web-based malware-analysis platform. Analysts upload a sample, choose static-only, safe simulation, or isolated CAPE analysis, then follow staged evidence collection through detection, correlation, scoring, and an exportable report. The main runtime controller is the 11-stage pipeline; the API serves the browser and streams analysis updates, while SQLite and quarantine preserve samples and results. The README documents the workflow and capabilities; several implementation links below rely on its architecture description and the pipeline’s indexed imports, since those source excerpts are incomplete.

Main entry points: pipeline.py 11-stage pipeline · main.py REST and WebSocket API · report.py Report assembly · storage.py SQLite and quarantine

Components 22

Analyst interface

Analysis console frontend/analyze.html
Browser API client frontend/js/api.js
Report interface frontend/js/report.js

API and orchestration

REST and WebSocket API backend/app/main.py
11-stage pipeline backend/app/pipeline.py
Event bus backend/app/bus.py

Analysis stages

Intake and identification backend/app/intake.py
Static analysis and YARA backend/app/static_analysis.py
Format analysis backend/app/formats.py
PDF inspection backend/app/pdf_analysis.py
Safe behavior simulation backend/app/simulation.py
Behavior detection backend/app/detection.py
Anomaly model backend/app/anomaly.py
Correlation and IOCs backend/app/correlation.py
Threat scoring backend/app/scoring.py

Evidence and reporting

SQLite and quarantine backend/app/storage.py
Report assembly backend/app/report.py
PDF export backend/app/pdf.py
Stages and methodology backend/app/methodology.py

External analysis

CAPE sandbox client backend/app/sandbox/cape.py

Other components

Analyst
CAPE host

Connections 25

Analyst → Analysis console: uploads sample README.md
Analysis console → Browser API client: uses client README.md
Browser API client → REST and WebSocket API: REST and WebSocket README.md
REST and WebSocket API → 11-stage pipeline: starts analysis backend/app/main.py
REST and WebSocket API → SQLite and quarantine: persists results README.md
REST and WebSocket API → Event bus: publishes updates README.md
11-stage pipeline → Intake and identification: validates sample backend/app/pipeline.py
11-stage pipeline → Static analysis and YARA: runs static scan backend/app/pipeline.py
Static analysis and YARA → Format analysis: analyzes formats backend/app/static_analysis.py
Format analysis → PDF inspection: delegates PDFs backend/app/formats.py
11-stage pipeline → Safe behavior simulation: projects behavior backend/app/pipeline.py
11-stage pipeline → CAPE sandbox client: submits gated run README.md
CAPE sandbox client → CAPE host: submits sample backend/app/sandbox/cape.py
11-stage pipeline → Behavior detection: runs detection backend/app/pipeline.py
11-stage pipeline → Anomaly model: scores anomaly backend/app/pipeline.py
11-stage pipeline → Correlation and IOCs: correlates evidence backend/app/pipeline.py
11-stage pipeline → Threat scoring: classifies threat backend/app/pipeline.py
11-stage pipeline → SQLite and quarantine: stores events README.md
11-stage pipeline → Event bus: publishes events README.md
11-stage pipeline → Report assembly: builds results backend/app/pipeline.py
Report assembly → SQLite and quarantine: reads stored evidence backend/app/report.py
Report assembly → Stages and methodology: uses stage definitions backend/app/report.py
Report assembly → PDF export: exports PDF README.md
REST and WebSocket API → Report interface: serves report data README.md
Report interface → Analyst: presents findings README.md

More Python diagrams: thefourgreaterrors/alpha-rptr · kubeflow/kale · robinostlund/homeassistant-volkswagencarnet · tsinghuadatabasegroup/db-gpt · b12io/orchestra

Drawn by GitDiagram on November 10, 2026 from the repository's file tree, README and source files. Read as Markdown ·