# susanth1436/adaptive-telemetry-malware-analysis architecture

> Architecture diagram of the GitHub repository susanth1436/adaptive-telemetry-malware-analysis, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/susanth1436/adaptive-telemetry-malware-analysis
- Repository: https://github.com/susanth1436/adaptive-telemetry-malware-analysis

## Overview

Adaptive Telemetry is a web-based malware-analysis platform. Analysts upload a sample, choose static-only, safe simulation, or isolated CAPE analysis, then follow staged evidence collection through detection, correlation, scoring, and an exportable report. The main runtime controller is the 11-stage pipeline; the API serves the browser and streams analysis updates, while SQLite and quarantine preserve samples and results. The README documents the workflow and capabilities; several implementation links below rely on its architecture description and the pipeline’s indexed imports, since those source excerpts are incomplete.

Main entry points: [`backend/app/pipeline.py`](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/pipeline.py) (11-stage pipeline), [`backend/app/main.py`](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/main.py) (REST and WebSocket API), [`backend/app/report.py`](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/report.py) (Report assembly), [`backend/app/storage.py`](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/storage.py) (SQLite and quarantine)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["Analyst interface"]
  node_console["Analysis console<br/>[analyze.html]"]
  node_browser_api["Browser API client<br/>[api.js]"]
  node_report_ui["Report interface<br/>[report.js]"]
end

subgraph group_service["API and orchestration"]
  node_api["REST and WebSocket API<br/>[main.py]"]
  node_pipeline["11-stage pipeline<br/>[pipeline.py]"]
  node_bus["Event bus<br/>[bus.py]"]
end

subgraph group_analysis["Analysis stages"]
  node_intake["Intake and identification<br/>[intake.py]"]
  node_static["Static analysis and YARA<br/>[static_analysis.py]"]
  node_formats["Format analysis<br/>[formats.py]"]
  node_pdf_analysis["PDF inspection<br/>[pdf_analysis.py]"]
  node_simulation["Safe behavior simulation<br/>[simulation.py]"]
  node_behavior["Behavior detection<br/>[detection.py]"]
  node_anomaly["Anomaly model<br/>[anomaly.py]"]
  node_correlation["Correlation and IOCs<br/>[correlation.py]"]
  node_scoring["Threat scoring<br/>[scoring.py]"]
end

subgraph group_evidence["Evidence and reporting"]
  node_storage[("SQLite and quarantine<br/>[storage.py]")]
  node_report["Report assembly<br/>[report.py]"]
  node_pdf_export["PDF export<br/>[pdf.py]"]
  node_methodology["Stages and methodology<br/>[methodology.py]"]
end

subgraph group_external["External analysis"]
  node_cape["CAPE sandbox client<br/>[cape.py]"]
end

node_analyst(("Analyst"))
node_cape_host["CAPE host"]

node_analyst -->|"uploads sample"| node_console
node_console -->|"uses client"| node_browser_api
node_browser_api -->|"REST and WebSocket"| node_api
node_api -->|"starts analysis"| node_pipeline
node_api -->|"persists results"| node_storage
node_api -->|"publishes updates"| node_bus
node_pipeline -->|"validates sample"| node_intake
node_pipeline -->|"runs static scan"| node_static
node_static -->|"analyzes formats"| node_formats
node_formats -->|"delegates PDFs"| node_pdf_analysis
node_pipeline -->|"projects behavior"| node_simulation
node_pipeline -->|"submits gated run"| node_cape
node_cape -->|"submits sample"| node_cape_host
node_pipeline -->|"runs detection"| node_behavior
node_pipeline -->|"scores anomaly"| node_anomaly
node_pipeline -->|"correlates evidence"| node_correlation
node_pipeline -->|"classifies threat"| node_scoring
node_pipeline -->|"stores events"| node_storage
node_pipeline -->|"publishes events"| node_bus
node_pipeline -->|"builds results"| node_report
node_report -->|"reads stored evidence"| node_storage
node_report -->|"uses stage definitions"| node_methodology
node_report -->|"exports PDF"| node_pdf_export
node_api -->|"serves report data"| node_report_ui
node_report_ui -->|"presents findings"| node_analyst

click node_console "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/frontend/analyze.html"
click node_browser_api "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/frontend/js/api.js"
click node_report_ui "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/frontend/js/report.js"
click node_api "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/main.py"
click node_pipeline "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/pipeline.py"
click node_intake "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/intake.py"
click node_static "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/static_analysis.py"
click node_formats "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/formats.py"
click node_pdf_analysis "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/pdf_analysis.py"
click node_simulation "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/simulation.py"
click node_cape "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/sandbox/cape.py"
click node_behavior "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/detection.py"
click node_anomaly "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/anomaly.py"
click node_correlation "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/correlation.py"
click node_scoring "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/scoring.py"
click node_storage "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/storage.py"
click node_bus "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/bus.py"
click node_report "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/report.py"
click node_pdf_export "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/pdf.py"
click node_methodology "https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/methodology.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_console,node_browser_api,node_report_ui toneBlue
class node_api,node_pipeline,node_bus toneAmber
class node_intake,node_static,node_formats,node_pdf_analysis,node_simulation,node_behavior,node_anomaly,node_correlation,node_scoring toneMint
class node_storage,node_report,node_pdf_export,node_methodology toneRose
class node_cape,node_analyst,node_cape_host toneIndigo
```

## Components

### Analyst interface

- [Analysis console](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/frontend/analyze.html): `frontend/analyze.html`
- [Browser API client](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/frontend/js/api.js): `frontend/js/api.js`
- [Report interface](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/frontend/js/report.js): `frontend/js/report.js`

### API and orchestration

- [REST and WebSocket API](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/main.py): `backend/app/main.py`
- [11-stage pipeline](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/pipeline.py): `backend/app/pipeline.py`
- [Event bus](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/bus.py): `backend/app/bus.py`

### Analysis stages

- [Intake and identification](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/intake.py): `backend/app/intake.py`
- [Static analysis and YARA](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/static_analysis.py): `backend/app/static_analysis.py`
- [Format analysis](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/formats.py): `backend/app/formats.py`
- [PDF inspection](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/pdf_analysis.py): `backend/app/pdf_analysis.py`
- [Safe behavior simulation](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/simulation.py): `backend/app/simulation.py`
- [Behavior detection](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/detection.py): `backend/app/detection.py`
- [Anomaly model](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/anomaly.py): `backend/app/anomaly.py`
- [Correlation and IOCs](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/correlation.py): `backend/app/correlation.py`
- [Threat scoring](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/scoring.py): `backend/app/scoring.py`

### Evidence and reporting

- [SQLite and quarantine](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/storage.py): `backend/app/storage.py`
- [Report assembly](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/report.py): `backend/app/report.py`
- [PDF export](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/pdf.py): `backend/app/pdf.py`
- [Stages and methodology](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/methodology.py): `backend/app/methodology.py`

### External analysis

- [CAPE sandbox client](https://github.com/susanth1436/adaptive-telemetry-malware-analysis/blob/main/backend/app/sandbox/cape.py): `backend/app/sandbox/cape.py`

### Other components

- **Analyst**
- **CAPE host**

## Connections

- Analyst → Analysis console: uploads sample (evidence: `README.md`)
- Analysis console → Browser API client: uses client (evidence: `README.md`)
- Browser API client → REST and WebSocket API: REST and WebSocket (evidence: `README.md`)
- REST and WebSocket API → 11-stage pipeline: starts analysis (evidence: `backend/app/main.py`)
- REST and WebSocket API → SQLite and quarantine: persists results (evidence: `README.md`)
- REST and WebSocket API → Event bus: publishes updates (evidence: `README.md`)
- 11-stage pipeline → Intake and identification: validates sample (evidence: `backend/app/pipeline.py`)
- 11-stage pipeline → Static analysis and YARA: runs static scan (evidence: `backend/app/pipeline.py`)
- Static analysis and YARA → Format analysis: analyzes formats (evidence: `backend/app/static_analysis.py`)
- Format analysis → PDF inspection: delegates PDFs (evidence: `backend/app/formats.py`)
- 11-stage pipeline → Safe behavior simulation: projects behavior (evidence: `backend/app/pipeline.py`)
- 11-stage pipeline → CAPE sandbox client: submits gated run (evidence: `README.md`)
- CAPE sandbox client → CAPE host: submits sample (evidence: `backend/app/sandbox/cape.py`)
- 11-stage pipeline → Behavior detection: runs detection (evidence: `backend/app/pipeline.py`)
- 11-stage pipeline → Anomaly model: scores anomaly (evidence: `backend/app/pipeline.py`)
- 11-stage pipeline → Correlation and IOCs: correlates evidence (evidence: `backend/app/pipeline.py`)
- 11-stage pipeline → Threat scoring: classifies threat (evidence: `backend/app/pipeline.py`)
- 11-stage pipeline → SQLite and quarantine: stores events (evidence: `README.md`)
- 11-stage pipeline → Event bus: publishes events (evidence: `README.md`)
- 11-stage pipeline → Report assembly: builds results (evidence: `backend/app/pipeline.py`)
- Report assembly → SQLite and quarantine: reads stored evidence (evidence: `backend/app/report.py`)
- Report assembly → Stages and methodology: uses stage definitions (evidence: `backend/app/report.py`)
- Report assembly → PDF export: exports PDF (evidence: `README.md`)
- REST and WebSocket API → Report interface: serves report data (evidence: `README.md`)
- Report interface → Analyst: presents findings (evidence: `README.md`)