Kavach.ai
Security analysts need to know what a suspicious binary actually does before detonating it in production, and standard tools only flag static hashes.
A desktop cybersecurity threat triage suite that detonates suspicious binaries inside an isolated, disposable Docker sandbox, fuses static file entropy analysis with dynamic syscall flagging, and uses an XGBoost classifier trained on ~184 GB of malware bytecode.
Electron desktop app frontend communicating with a Python/Flask engine. Combines static entropy analysis, dynamic syscall logging in ephemeral Docker sandboxes, an XGBoost classifier with pseudo-soft labeling, and a fine-tuned LLaMA 3.2 model that translates call-stack telemetry into plain-language security verdicts. Validated live against GajShield malware samples during judging.