diff --git a/docs/architecture.svg b/docs/architecture.svg index 9fd590e..b84875c 100644 --- a/docs/architecture.svg +++ b/docs/architecture.svg @@ -1,128 +1 @@ - - - - - - - - - - - - -"Client" - - -"Jarspect (Axum server · src/main.rs)" - - -"Local storage" - - -"Scan pipeline (src/lib.rs · run_scan)" - - -"Signature data" - - - - - - - - - - - - - - - - - - - - - - - - - - - -write jar - -read jar - -persist result - -read result - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Browser UI\nhttp://localhost:18000/ -bash scripts/demo_run.sh -Router -GET /health -POST /upload\n-> upload_id -POST /scan\n-> scan_id + result -GET /scans/{scan_id} -.local-data/uploads/*.jar -.local-data/scans/{scan_id}.json -Archive traversal\nrecursive jar-in-jar\nbudget-gated inflation -Bytecode evidence\ncafebabe class parse\nCP strings + invoke resolve -Byte-array strings\nnew String·new byte·...·\nopcode state machine -YARA per-entry\ninflate + scan individually\nseverity from rule metadata -Metadata checks\nfabric.mod.json / mods.toml\nplugin.yml / MANIFEST.MF -8 Capability detectors\nDETC-01..08\nEvidenceIndex + correlation gates -Scoring engine\ndedup + diminishing returns\nsynergy bonuses -> 0-100 -Behavior prediction\nevidence-derived URLs\ncommands / paths / persistence -Reputation scoring\nauthor metadata · optional -Verdict synthesis\nrisk_tier · risk_score\nsummary · explanation · indicators -data/signatures/demo/\nsignatures.json + rules.yar -data/signatures/prod/\nsignatures.json + rules.yar - \ No newline at end of file +"Client""Jarspect (Axum server · src/main.rs)""Local storage""Scan pipeline (src/lib.rs · run_scan)""Signature data"write jarread jarpersist resultread resultBrowser UI\nhttp://localhost:18000/bash scripts/demo_run.shRouterGET /healthPOST /upload\n-> upload_idPOST /scan\n-> scan_id + resultGET /scans/{scan_id}.local-data/uploads/*.jar.local-data/scans/{scan_id}.jsonArchive traversal\nrecursive jar-in-jar\nbudget-gated inflationBytecode evidence\ncafebabe class parse\nCP strings + invoke resolveByte-array strings\nnew String·new byte·...·\nopcode state machineYARA per-entry\ninflate + scan individually\nseverity from rule metadataMetadata checks\nfabric.mod.json / mods.toml\nplugin.yml / MANIFEST.MF8 Capability detectors\nDETC-01..08\nEvidenceIndex + correlation gatesScoring engine\ndedup + diminishing returns\nsynergy bonuses -> 0-100Behavior prediction\nevidence-derived URLs\ncommands / paths / persistenceReputation scoring\nauthor metadata · optionalVerdict synthesis\nrisk_tier · risk_score\nsummary · explanation · indicatorsdata/signatures/demo/\nsignatures.json + rules.yardata/signatures/prod/\nsignatures.json + rules.yar \ No newline at end of file diff --git a/docs/benchmarks/ablation-verdict-distribution.svg b/docs/benchmarks/ablation-verdict-distribution.svg index 3765644..50ecf88 100644 --- a/docs/benchmarks/ablation-verdict-distribution.svg +++ b/docs/benchmarks/ablation-verdict-distribution.svg @@ -1,50 +1 @@ - - - - -Ablation: verdict distribution -Baseline vs AI-off (prod rules) vs AI-off (demo rules) -Baseline (prod + AI) / malware (n=70) - - -70 -Baseline (prod + AI) / benign (n=50) - - -50 -AI off (prod) / malware (n=70) - - -70 -AI off (prod) / benign (n=50) - - -43 - -7 -AI off (demo) / malware (n=70) - - - - -66 -AI off (demo) / benign (n=50) - - -39 - -10 - - -CLEAN - -SUSPICIOUS - -MALICIOUS - +Ablation: verdict distributionBaseline vs AI-off (prod rules) vs AI-off (demo rules)Baseline (prod + AI) / malware (n=70)70Baseline (prod + AI) / benign (n=50)50AI off (prod) / malware (n=70)70AI off (prod) / benign (n=50)437AI off (demo) / malware (n=70)66AI off (demo) / benign (n=50)3910CLEANSUSPICIOUSMALICIOUS \ No newline at end of file diff --git a/docs/benchmarks/baseline-capability-prevalence.svg b/docs/benchmarks/baseline-capability-prevalence.svg index 31e3584..482e341 100644 --- a/docs/benchmarks/baseline-capability-prevalence.svg +++ b/docs/benchmarks/baseline-capability-prevalence.svg @@ -1,84 +1 @@ - - - - -Capability prevalence (baseline) -Fraction of samples where the capability is present at medium/high severity. - - -0% - -25% - -50% - -75% - -100% -dynamic loading - - -94.3% - - -2.0% -network - - -78.6% - - -18.0% -filesystem - - -75.7% - - -6.0% -credential theft - - -0.0% - - -0.0% -deserialization - - -0.0% - - -8.0% -execution - - -0.0% - - -0.0% -native loading - - -0.0% - - -8.0% -persistence - - -0.0% - - -0.0% - -malware - -benign - +Capability prevalence (baseline)Fraction of samples where the capability is present at medium/high severity.0%25%50%75%100%dynamic loading94.3%2.0%network78.6%18.0%filesystem75.7%6.0%credential theft0.0%0.0%deserialization0.0%8.0%execution0.0%0.0%native loading0.0%8.0%persistence0.0%0.0%malwarebenign \ No newline at end of file diff --git a/docs/benchmarks/baseline-method-attribution.svg b/docs/benchmarks/baseline-method-attribution.svg index 088a5f7..39b57a3 100644 --- a/docs/benchmarks/baseline-method-attribution.svg +++ b/docs/benchmarks/baseline-method-attribution.svg @@ -1,31 +1 @@ - - - - -Verdict method attribution (baseline) -Shows how many malware samples are locked to MALICIOUS by static override vs AI verdict alone. -MalwareBazaar strict-modlike (n=70) - - -63 - -7 -Modrinth top-50 (n=50) - - -50 - -static_override(ai_verdict) - -ai_verdict - -static_override(heuristic_fallback) - -heuristic_fallback - +Verdict method attribution (baseline)Shows how many malware samples are locked to MALICIOUS by static override vs AI verdict alone.MalwareBazaar strict-modlike (n=70)637Modrinth top-50 (n=50)50static_override(ai_verdict)ai_verdictstatic_override(heuristic_fallback)heuristic_fallback \ No newline at end of file diff --git a/docs/benchmarks/baseline-top-capability-combos.svg b/docs/benchmarks/baseline-top-capability-combos.svg index e666cb7..9a236f6 100644 --- a/docs/benchmarks/baseline-top-capability-combos.svg +++ b/docs/benchmarks/baseline-top-capability-combos.svg @@ -1,58 +1 @@ - - - - -Top capability intersections (baseline) -malware (n=70) -dynamic_loading+filesystem+... - - -53 -dynamic_loading - - -13 -(none) - - -2 -network - - -2 -benign (n=50) -(none) - - -35 -deserialization+network - - -4 -native_loading - - -3 -network - - -3 -filesystem - - -2 -dynamic_loading - - -1 - -malware - -benign - +Top capability intersections (baseline)malware (n=70)dynamic_loading+filesystem+...53dynamic_loading13(none)2network2benign (n=50)(none)35deserialization+network4native_loading3network3filesystem2dynamic_loading1malwarebenign \ No newline at end of file diff --git a/docs/benchmarks/baseline-verdict-distribution.svg b/docs/benchmarks/baseline-verdict-distribution.svg index a0bc753..faf04ca 100644 --- a/docs/benchmarks/baseline-verdict-distribution.svg +++ b/docs/benchmarks/baseline-verdict-distribution.svg @@ -1,27 +1 @@ - - - - -Verdict distribution (baseline) -Malware detection: 100% (Wilson 95% 94.8%-100.0%); Benign clean: 100% (Wilson 95% 92.9%-100.0%) -MalwareBazaar strict-modlike (n=70) - - -70 -Modrinth top-50 (n=50) - - -50 - -CLEAN - -SUSPICIOUS - -MALICIOUS - +Verdict distribution (baseline)Malware detection: 100% (Wilson 95% 94.8%-100.0%); Benign clean: 100% (Wilson 95% 92.9%-100.0%)MalwareBazaar strict-modlike (n=70)70Modrinth top-50 (n=50)50CLEANSUSPICIOUSMALICIOUS \ No newline at end of file diff --git a/docs/brand/logo-horizontal.svg b/docs/brand/logo-horizontal.svg index 9f3737b..ebb7dcf 100644 --- a/docs/brand/logo-horizontal.svg +++ b/docs/brand/logo-horizontal.svg @@ -1,17 +1 @@ - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/docs/brand/logo.svg b/docs/brand/logo.svg index c27bacf..62d0759 100644 --- a/docs/brand/logo.svg +++ b/docs/brand/logo.svg @@ -1,9 +1 @@ - - - - - - - - - + \ No newline at end of file diff --git a/web/brand/logo-horizontal.svg b/web/brand/logo-horizontal.svg index 9f3737b..ebb7dcf 100644 --- a/web/brand/logo-horizontal.svg +++ b/web/brand/logo-horizontal.svg @@ -1,17 +1 @@ - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/web/brand/logo.svg b/web/brand/logo.svg index c27bacf..62d0759 100644 --- a/web/brand/logo.svg +++ b/web/brand/logo.svg @@ -1,9 +1 @@ - - - - - - - - - + \ No newline at end of file diff --git a/web/screenshots/camofox-100.124.44.113-18000.png b/web/screenshots/camofox-100.124.44.113-18000.png index 519ff27..c1b05b3 100644 Binary files a/web/screenshots/camofox-100.124.44.113-18000.png and b/web/screenshots/camofox-100.124.44.113-18000.png differ diff --git a/web/screenshots/jarspect-full.png b/web/screenshots/jarspect-full.png index 86de3b6..f0873d4 100644 Binary files a/web/screenshots/jarspect-full.png and b/web/screenshots/jarspect-full.png differ