Malware Agent

A full-stack AI agent platform with Next.js frontend and FastAPI backend, featuring voice interaction, data analysis, and malware testing capabilities.

Architecture

graph TB
    subgraph "Frontend (Next.js)"
        UI[User Interface]
        VC[Voice Conversation]
        TTS[Text to Speech]
        DA[Data Analysis]
        MT[Malware Testing]
        
        UI --> VC
        UI --> TTS
        UI --> DA
        UI --> MT
    end
    
    subgraph "Backend (FastAPI)"
        API[FastAPI Server<br/>localhost:8000]
        
        subgraph "Agents"
            ELA[ElevenLabs Agent<br/>Voice & TTS]
            DAA[Data Analysis Agent<br/>LangChain + Gemini]
            MTA[Malware Testing Agent<br/>LangChain + Gemini]
        end
        
        API --> ELA
        API --> DAA
        API --> MTA
    end
    
    subgraph "External Services"
        EL[ElevenLabs API<br/>Voice & Speech]
        DT[Daytona Sandbox<br/>Secure Execution]
        GM[Google Gemini<br/>LLM Analysis]
    end
    
    subgraph "Data Flow"
        direction TB
        User[User Input] --> UI
        UI -->|HTTP/REST| API
        API -->|API Calls| EL
        API -->|Code Execution| DT
        API -->|LLM Requests| GM
        DT -->|Results| API
        GM -->|Analysis| API
        EL -->|Audio| API
        API -->|JSON/Audio| UI
        UI --> User
    end
    
    VC -.->|Audio Stream| ELA
    TTS -.->|Text| ELA
    DA -.->|Dataset + Prompt| DAA
    MT -.->|Script| MTA
    
    ELA -.->|TTS/STT| EL
    DAA -.->|Code| DT
    DAA -.->|Analysis Request| GM
    MTA -.->|Script Execution| DT
    MTA -.->|Threat Analysis| GM
    
    style UI fill:#3b82f6
    style API fill:#10b981
    style ELA fill:#f59e0b
    style DAA fill:#8b5cf6
    style MTA fill:#ef4444
    style EL fill:#ec4899
    style DT fill:#06b6d4
    style GM fill:#14b8a6

System Architecture

Component Overview

graph LR
    subgraph "Frontend Layer"
        A[React Components]
        B[API Client Libraries]
        C[State Management]
    end
    
    subgraph "Backend Layer"
        D[FastAPI Routes]
        E[Agent Orchestration]
        F[Error Handling]
    end
    
    subgraph "Agent Layer"
        G[ElevenLabs Agent]
        H[Data Analysis Agent]
        I[Malware Testing Agent]
    end
    
    subgraph "Service Layer"
        J[ElevenLabs API]
        K[Daytona Sandbox]
        L[Google Gemini]
    end
    
    A --> B
    B --> D
    D --> E
    E --> G
    E --> H
    E --> I
    G --> J
    H --> K
    H --> L
    I --> K
    I --> L

Malware Testing Pipeline

flowchart TD
    Start([User Uploads Script]) --> Stage1[Stage 1: Static Code Analysis]
    Stage1 -->|LLM Evaluation| Stage1Result[Threat Score & Patterns]
    
    Stage1Result --> Stage2[Stage 2: Sandbox Execution]
    Stage2 -->|Telemetry Wrapper| Stage2Result[Execution Output & Events]
    
    Stage2Result --> Stage3[Stage 3: Dynamic Analysis]
    Stage3 -->|LLM Evaluation| Stage3Result[Behavior Analysis]
    
    Stage3Result --> Stage4[Stage 4: Risk Score Calculation]
    Stage4 -->|Combine Scores| Stage4Result[Final Risk Assessment]
    
    Stage4Result --> Stage5[Stage 5: Recommendations]
    Stage5 --> Stage5Result[Security Recommendations]
    
    Stage5Result --> Stage6[Stage 6: Abnormalities Collection]
    Stage6 --> Stage6Result[Aggregated Findings]
    
    Stage6Result --> Stage7[Stage 7: Speaking Script Generation]
    Stage7 -->|LLM| Stage7Result[Natural Language Report]
    
    Stage7Result --> End([Results Displayed])
    
    style Stage1 fill:#3b82f6
    style Stage2 fill:#10b981
    style Stage3 fill:#8b5cf6
    style Stage4 fill:#f59e0b
    style Stage5 fill:#ec4899
    style Stage6 fill:#06b6d4
    style Stage7 fill:#14b8a6

Project Structure

Malware_Agent/
├── frontend/                    # Next.js application
│   ├── app/                     # Next.js app directory
│   │   ├── page.tsx            # Main page with tab navigation
│   │   ├── layout.tsx          # Root layout
│   │   └── globals.css         # Global styles
│   ├── components/              # React components
│   │   ├── VoiceConversation.tsx    # Voice interaction UI
│   │   ├── TextToSpeech.tsx         # TTS interface
│   │   ├── DataAnalysis.tsx         # Data analysis UI
│   │   └── MalwareTesting.tsx       # Malware testing UI
│   └── lib/                     # API client libraries
│       ├── api.ts              # ElevenLabs API client
│       ├── dataAnalysisApi.ts  # Data analysis API client
│       └── malwareTestingApi.ts # Malware testing API client
│
├── backend/                     # FastAPI application
│   ├── agent/                   # Agent implementations
│   │   ├── agent.py            # ElevenLabs agent (TTS/STT)
│   │   ├── data_analysis.py    # Data analysis agent
│   │   ├── malware_testing.py  # Malware testing agent
│   │   └── __init__.py         # Agent exports
│   ├── main.py                  # FastAPI application entry
│   └── requirements.txt         # Python dependencies
│
└── README.md                    # This file

Getting Started

Prerequisites

Node.js (v18 or higher)
Python 3.10 or higher
npm or yarn

Frontend Setup (Next.js)

Navigate to the frontend directory:

cd frontend

Install dependencies:

npm install

Run the development server:

npm run dev

The frontend will be available at http://localhost:3000

Backend Setup (FastAPI)

Navigate to the backend directory:

cd backend

Create and activate virtual environment:

python3 -m venv venv
source venv/bin/activate  # On macOS/Linux
# or
venv\Scripts\activate  # On Windows

Install dependencies:

pip install -r requirements.txt

Set up environment variables:

# Create a .env file in the backend directory
cat > .env << EOF
ELEVENLABS_API_KEY=your_elevenlabs_api_key
DAYTONA_API_KEY=your_daytona_api_key
GOOGLE_API_KEY=your_google_api_key
EOF

Run the development server:

uvicorn main:app --reload

The backend API will be available at http://localhost:8000

API documentation (Swagger UI) will be available at http://localhost:8000/docs

Features

🎤 Voice Conversation Agent

Speech-to-Text: Convert user voice input to text using ElevenLabs
Text-to-Speech: Generate natural-sounding voice responses
Real-time Conversation: Interactive voice-based communication
Voice Selection: Choose from multiple available voices

API Endpoints:

POST /api/agent/voice-conversation - Process voice conversation
POST /api/agent/text-to-speech - Convert text to speech
GET /api/agent/voices - Get list of available voices

📊 Data Analysis Agent

Secure Sandbox Execution: Python code runs in isolated Daytona sandboxes
Natural Language Interface: Describe analysis tasks in plain English
Automatic Chart Generation: Charts and visualizations are automatically captured
File Upload: Upload CSV, JSON, Excel files for analysis
Multi-step Workflows: Agent can perform complex multi-step data analysis
LLM-Powered: Uses Google Gemini for intelligent code generation

API Endpoints:

POST /api/data-analysis/upload - Upload a dataset file
POST /api/data-analysis/analyze - Run data analysis with natural language prompt
GET /api/data-analysis/sandbox - Get sandbox information
POST /api/data-analysis/close - Close and clean up sandbox

🛡️ Malware Testing Agent

Static Code Analysis: LLM-powered analysis of code structure and patterns
Dynamic Analysis: Execution in secure Daytona sandbox with telemetry monitoring
Threat Assessment: AI-powered threat scoring and risk level classification
Behavior Detection: Identifies network activity, file operations, process spawning
Security Recommendations: Automated security recommendations based on findings
Natural Language Reports: Generates speaking scripts for verbal security reports
7-Stage Pipeline: Comprehensive analysis pipeline from static analysis to report generation

API Endpoints:

POST /api/malware-testing/test - Test a script for malware behavior
GET /api/malware-testing/sandbox - Get sandbox information
POST /api/malware-testing/close - Close and clean up sandbox

Malware Testing Pipeline Details

The malware testing agent follows a 7-stage analysis pipeline:

Static Code Analysis (LLM): Analyzes code structure, imports, patterns, and obfuscation
Sandbox Execution: Executes script in isolated environment with telemetry monitoring
Dynamic Analysis (LLM): Analyzes execution output for malicious behavior
Risk Score Calculation: Combines static and dynamic threat scores (40% static, 60% execution)
Recommendations Generation: Creates security recommendations based on findings
Abnormalities Collection: Aggregates all findings into structured format
Speaking Script Generation (LLM): Generates natural language report for TTS

Technology Stack

Frontend

Framework: Next.js 14+ (React)
Language: TypeScript
Styling: Tailwind CSS
State Management: React Hooks

Backend

Framework: FastAPI
Language: Python 3.10+
API Documentation: Swagger/OpenAPI
CORS: Configured for frontend communication

Agents & Services

ElevenLabs: Voice synthesis and speech recognition
Daytona: Secure sandbox execution environment
Google Gemini: Large language model for analysis
LangChain: Agent orchestration and tool integration

API Keys Required

Required

ELEVENLABS_API_KEY: For voice conversation and TTS features
- Get from: ElevenLabs

Optional (for Data Analysis & Malware Testing)

DAYTONA_API_KEY: For secure sandbox execution
- Get from: Daytona Dashboard
GOOGLE_API_KEY: For LLM-powered analysis
- Get from: Google AI Studio

Optional Dependencies

For data analysis and malware testing features, install additional packages:

cd backend
source venv/bin/activate
pip install langchain langchain-google-genai langchain-daytona-data-analysis

Note: These packages may have dependency conflicts. If you encounter issues:

Use Python 3.10-3.12 (recommended)
Install obstore==0.8.2 first if needed
Resolve conflicts manually as needed

Development

Running Both Servers

Terminal 1 - Backend:

cd backend
source venv/bin/activate
uvicorn main:app --reload

Terminal 2 - Frontend:

cd frontend
npm run dev

Project Features

CORS: Configured to allow requests from frontend (localhost:3000)
Error Handling: Comprehensive error handling with user-friendly messages
Sandbox Management: Automatic cleanup of sandbox resources after use
Real-time Updates: Stage tracking for long-running operations
Type Safety: Full TypeScript support in frontend

License

This project is for educational and research purposes.

Name		Name	Last commit message	Last commit date
Latest commit History 14 Commits
backend		backend
frontend		frontend
.gitignore		.gitignore
About.md		About.md
README.md		README.md

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

Malware Agent

Architecture

System Architecture

Component Overview

Malware Testing Pipeline

Project Structure

Getting Started

Prerequisites

Frontend Setup (Next.js)

Backend Setup (FastAPI)

Features

🎤 Voice Conversation Agent

📊 Data Analysis Agent

🛡️ Malware Testing Agent

Malware Testing Pipeline Details

Technology Stack

Frontend

Backend

Agents & Services

API Keys Required

Required

Optional (for Data Analysis & Malware Testing)

Optional Dependencies

Development

Running Both Servers

Project Features

License

About

Uh oh!

Releases

Packages

Contributors 2

Uh oh!

Languages

JaredAung/Malware_Agent

Folders and files

Latest commit

History

Repository files navigation

Malware Agent

Architecture

System Architecture

Component Overview

Malware Testing Pipeline

Project Structure

Getting Started

Prerequisites

Frontend Setup (Next.js)

Backend Setup (FastAPI)

Features

🎤 Voice Conversation Agent

📊 Data Analysis Agent

🛡️ Malware Testing Agent

Malware Testing Pipeline Details

Technology Stack

Frontend

Backend

Agents & Services

API Keys Required

Required

Optional (for Data Analysis & Malware Testing)

Optional Dependencies

Development

Running Both Servers

Project Features

License

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Contributors 2

Uh oh!

Languages

Packages