NtWarden

NtWARden Windows 分析与研究工具包 基于 ImGui + DirectX 11 构建的 Windows 系统检查工具。 涵盖进程、服务、网络、内核内部机制等——支持本地检查或通过 WinSysServer 进行远程检查。 ⚠️ 本项目的部分代码在 AI 辅助下编写（vibe coding），因此可能存在一些缺陷。 内核驱动（KWinSys）应仅安装在测试虚拟机中，仅供研究使用。 屏幕截图 进程（内核模式） 进程（用户模式）| ETW 会话| 内核回调 ---|---|--- 内核池| 符号| 过滤器 架构 组件| 作用 ---|--- NtWarden| GUI...

Detecting Concept Drift in Evolving Malware Families Using Rule-Based Classifier Representations

This work proposes a structural approach to concept drift detection in malware classification using decision tree rulesets. Classifiers are trained across temporal windows on the EMBER2024 dataset, and drift is quantified by comparing extracted rule representations using feature importance,...

Recorded Future Triage 安全漏洞

Recorded Future Triage is a cloud sandboxing service from US-based Recorded Future. A security vulnerability exists in Recorded Future Triage that stems from a Windows behavioral analysis engine that allows malicious samples to evade detection by recursively spawning a large number of child...