01 / The problem
Make static malware signals explainable.
Static PE/ELF indicators such as headers, entropy and API imports need to become reviewable signals rather than an opaque model score.
04 / MALWAREGUARD-AI / OPEN SOURCE
MalwareGuard-AI
Make static malware signals explainable.
A research and engineering build for explainable static malware analysis.
Role & responsibility
Built the documented analysis pipeline and service surface for feature extraction, model comparison and explainability.
Verified result
Repository and project description are publicly available; benchmark performance is not claimed here.
02 / Solution
Architecture & workflow
File-format feature extraction feeds Random Forest and XGBoost models; SHAP explanations and a FastAPI boundary expose reviewable results.
Technical implementation
- Extracted structural and behavioral indicators from PE/ELF inputs.
- Compared tree-based models for static classification.
- Added SHAP explainability to connect predictions back to features.
- Wrapped the workflow in a hardened FastAPI service.
Key engineering decisions
- Keep model output paired with explainability signals.
- Separate feature extraction from API delivery so the analysis can be tested independently.
Completed deliverables
- Static analysis pipeline
- Random Forest and XGBoost model paths
- SHAP explanation layer
- FastAPI service
- Public repository
Technology stack
PythonRandom ForestXGBoostSHAPFastAPI
Evidence surfaceNo approved screenshot published
Public repository is the evidence surface. Read benchmark details and supported inputs from the repository itself.