MalGuard

• 

  MalGuard SOC Overview Real-time telemetry dashboard monitoring incoming file inspections, threat ratios, and triage status.

• 

  Static PE File Threat Analyzer — Shannon entropy measurement, suspicious Win32 API extraction, and Gradient Boosting ML classification.

• 

  Detailed Forensic Incident Report — Instant audit trail with cryptographic hashes (SHA-256/MD5), PE section headers, and threat indicators.

• 

  Threat Encyclopedia & 4-Phase CIRP Playbook — Actionable containment, eradication, and recovery checklists mapped to MITRE ATT&CK.

• 

  Safe Sandbox Simulator — Interactive demonstration testing heuristic detection rules and entropy spikes safely without live malware.

Inspiration

Almost everyone who has worked with computers has seen an antivirus alert pop up saying "Threat Detected". But if you're a student, developer, or junior security analyst, that alert is basically a black box. It doesn't tell you what the file is trying to do, whether it's stealing credentials, encrypting your disk, or injecting code into another process.

To actually understand a binary, you usually have to fire up a heavy virtual machine, configure disassemblers like Ghidra or IDA Pro, and manually dig through assembly instructions. That has a steep learning curve and carries real risk if you mishandle the sample.

We built MalGuard because we wanted a middle ground: a safe, web-based triage tool where you can drop in a suspicious Windows executable and immediately get transparent heuristics, byte entropy measurements, and an incident response playbook—all without running a single line of malicious code.

What it does

MalGuard is a lightweight Security Operations Center (SOC) dashboard and static binary analysis tool. When you upload a Windows executable (.exe or .dll), it:

Calculates Cryptographic Hashes: Generates SHA-256, MD5, and SHA-1 fingerprints for threat intel lookups. Measures Shannon Entropy: Computes byte-level randomness across the file sections using information theory: $$H(X) = -\sum_{i=1}^{n} P(x_i) \log_2 P(x_i)$$ Where $P(x_i)$ is the frequency of each byte value ($0$ to $255$). If $H(X) > 7.0$, it immediately flags the binary as packed or encrypted (a common trick used by malware like UPX or custom crypters to evade basic signatures). Disassembles PE Headers & Categorizes APIs: Inspects the file's Import Address Table (IAT) without execution, catching red-flag Win32 API imports such as VirtualAllocEx (process injection) or CryptEncrypt (ransomware). Runs an ML Classification Engine: A Gradient Boosting classifier evaluates these extracted features to predict the malware family (Ransomware, Trojan, Spyware, Worm, or Benign) and displays the specific indicators that drove the verdict. Provides a 4-Phase CIRP Playbook: Bridges detection with action by generating step-by-step Containment, Eradication, Recovery, and Prevention checklists mapped to the MITRE ATT&CK framework. Includes a Safe Sandbox Simulator: Allows anyone to test detection vectors and see heuristic alerts trigger live in the browser without needing real malware files. How we built it We designed MalGuard with a decoupled client-server architecture:

The Frontend (React, Vite, Tailwind CSS)

The frontend of MalGuard serves as the primary bridge between complex security analysis and the user. Developed with React, Vite, and Tailwind CSS, the interface prioritizes clarity and responsiveness to keep critical security data from feeling overwhelming. Users can upload suspicious files through an intuitive drag-and-drop interface, immediately receiving an organized breakdown of potential risks, threat scores, and MITRE ATT&CK patterns. Rather than presenting isolated raw metrics, the frontend contextualizes each scan through clear visual cues, an integrated malware encyclopedia, and historical logs, allowing users to make informed decisions quickly without needing extensive cybersecurity expertise.

The Backend (Python / FastAPI):

Uses pefile to parse Portable Executable (PE) headers, section tables, and import directories safely. Implements custom math functions for byte-frequency entropy calculations. Uses scikit-learn and joblib to host our trained Gradient Boosting model for threat classification. Built with asynchronous endpoints in FastAPI and deployed as a web service on Render. The Frontend (React 18 / Vite / Tailwind CSS):

Built a responsive dark/light SOC dashboard using modern Tailwind styling and Lucide icons. Includes interactive entropy gauges, filterable audit history logs, and modal-based incident report viewers. Implemented client-side fallback mocks so the demo remains responsive even when the backend is cold-starting. Deployed on Vercel for fast global edge delivery. Challenges we ran into Safe Parsing of Malformed Files: Malware binaries are often intentionally corrupted, stripped of standard headers, or packed with weird section names to crash analysis tools. We had to write defensive exception handling around pefile to ensure strange or broken binaries failed gracefully instead of crashing the FastAPI worker. Balancing Entropy Accuracy with Speed: Calculating byte frequencies over multi-megabyte files in real-time can easily cause request timeouts. We optimized our chunk-reading pipeline in Python so entropy scores compute in milliseconds. Bridging the Cloud Services: With the frontend on Vercel and the backend on Render's free tier, we had to handle CORS policies, asynchronous multipart uploads, and cold start delays. We built an active healthcheck badge in the UI and resilient fallbacks so judges never get stuck on a broken screen. Cutting the Noise: Early iterations had too many confusing charts and experimental forms. We made the deliberate decision to strip out clutter and focus on what judges actually care about: a fast, reliable, and explainable analysis workflow. Accomplishments that we're proud of Zero-Execution Safety: The entire analysis pipeline is 100% static. Users can inspect potentially dangerous files without the danger of an accidental sandbox escape. Explainable Heuristics: Instead of just giving an opaque percentage, MalGuard shows the exact suspicious APIs and entropy levels that caused the flag. Polished, Production-Grade UX: The interface feels like a real security platform rather than a rough hackathon script, complete with MITRE ATT&CK references and practical response playbooks.

What we learned

The inner workings of the Windows Portable Executable (PE) format—how DOS headers, COFF headers, optional headers, and section tables interact. How attackers use packing and encryption to manipulate entropy, and how defense tools use mathematical variance to catch them. How to connect machine learning outputs to real-world cybersecurity frameworks (MITRE ATT&CK) so that predictions translate directly into defensive actions.

What's next for MalGuard

Cross-Platform Static Analysis: Extending the parser to support Linux ELF binaries and macOS Mach-O files. Custom YARA Rule Engine: Allowing analysts to paste custom YARA rules and scan uploaded binaries against their own threat signatures. Automated Memory Dump Analysis: Adding support for parsing small process memory dumps (.dmp) to detect in-memory reflective DLL loading.

Built With

• cybersecurity
• fastapi
• git
• github
• heuristic-analysis
• incident-response
• javascript
• machine-learning
• malware-analysis
• mitre-attack
• pefile
• pydantic
• python
• react
• render
• reverse-engineering
• scikit-learn
• shannon-entropy
• soc
• sqlalchemy
• static-analysis
• tailwindcss
• uvicorn
• vercel
• vite