How zahraaabidha/astra works
ASTRA is a prototype malware-analysis service: an analyst submits a file, the backend extracts features, scores risk, conditionally runs Tier 2 analysis, and returns a structured report for review. The implemented pipeline and API support this core workflow; the README also describes multi-format routing and cross-sample knowledge-graph capabilities, but the graph directory has no implementation shown. Dynamic sandbox verification is likewise described as a capability, while sampled Tier 2 code validates citations. Upload and history page internals were not sampled, so their API wiring is omitted.
Main entry points: main.py HTTP API · App.tsx Dashboard shell · pipeline.py Analysis orchestrator · train.py Classifier training
Components 21
Analyst interface
- Dashboard shell
frontend/src/App.tsx - File upload
frontend/src/pages/UploadPage.tsx - Report view
frontend/src/pages/ResultsPage.tsx - Analysis history
frontend/src/pages/HistoryPage.tsx - Service status
frontend/src/components/Navbar.tsx
Analysis service
- HTTP API
backend/api/main.py - Analysis orchestrator
backend/pipeline.py - Report builder
backend/tier2/reporter.py
Feature scoring
- Format extraction
analysis/static/extractor.py - Risk scorer
backend/ml/scorer.py - Classifier training
backend/ml/train.py
Deep analysis
- Reverse engineering
backend/tier2/deobfuscator.py - Campaign graph
backend/graph
Analysis state
- Training data
data/models/training_data.csv - Model artifacts
data/models - Uploaded samples
backend/api/main.py - Job status
backend/api/main.py - Saved reports
backend/api/main.py - Bank references
data/reference_db/bank_apps.json
Other components
- Analyst
- Ollama model service
Connections 20
- Analyst → Dashboard shell: uses
- Dashboard shell → File upload: shows
- Dashboard shell → Report view: shows
- Dashboard shell → Analysis history: shows
- Dashboard shell → Service status: shows
- Service status → HTTP API: checks health
- Report view → HTTP API: fetches report
- HTTP API → Uploaded samples: writes upload
- HTTP API → Job status: tracks job
- HTTP API → Analysis orchestrator: dispatches analysis
- Analysis orchestrator → Format extraction: extracts features
- Format extraction → Bank references: reads bank data
- Analysis orchestrator → Risk scorer: scores features
- Analysis orchestrator → Reverse engineering: routes when needed
- Reverse engineering → Ollama model service: requests analysis
- Analysis orchestrator → Report builder: builds report
- HTTP API → Saved reports: writes report
- Classifier training → Training data: trains from
- Classifier training → Model artifacts: saves model
- Risk scorer → Model artifacts: loads model