Overview
The UC Intel Final platform is a comprehensive malware classification system built with a modern, modular architecture that separates concerns between the web interface (Streamlit), machine learning models (PyTorch), and training pipeline.Streamlit UI
Interactive multi-page dashboard for experiment configuration and monitoring
PyTorch Models
Custom CNN, Transfer Learning, and Vision Transformer architectures
Training Pipeline
Background training engine with real-time monitoring and checkpointing
State Management
File-based persistence with session state abstraction
High-Level Architecture
Application Architecture
Directory Structure
The platform follows a self-contained architecture where each module is isolated and communicates through well-defined interfaces:The architecture uses NO
__init__.py files - all imports use absolute paths from the project root (e.g., from models.pytorch.cnn_builder import CustomCNNBuilder).Architecture Principles
1. Self-Contained Page Modules
Each page incontent/ is fully self-contained with:
page.py- Entry point that renders header/sidebar and calls viewview.py- Main view logic and coordinatortabs/- Optional subfolder for complex multi-tab pages
2. State Management Abstraction
Critical Design Pattern: All session state access goes through
state/ module functions. NEVER access st.session_state directly from page code.workflow.py- ML workflow state (configs, training status, results)ui.py- UI preferences (theme, past sessions)cache.py- Cached operations (dataset scans, expensive computations)
app/state/workflow.py:57-365 for complete implementation.
3. Background Training with Thread Safety
Training runs in a background thread to avoid blocking the UI. The worker uses file-based I/O instead ofst.session_state since session state is thread-local:
app/training/worker.py:45-257 for complete implementation.
4. Model Architecture Pattern
All models inherit fromBaseModel abstract class and implement:
build()- Constructs and returns the PyTorchnn.Moduleget_parameters_count()- Returns total and trainable parameter countsvalidate_config()- Validates model configuration
app/models/base.py:11-71 for complete implementation.
Data Flow
Configuration Flow
Training Flow
Real-Time Monitoring
The monitoring page uses Streamlit’s@st.fragment(run_every="1s") to create auto-refreshing components:
.md/arch.md:432-464 for complete pattern.
Component Architecture
Shared Components
Components are flat, reusable modules that can be imported by any page:- Header
- Theme
- Utils
Location:
app/components/header.pyRenders the application header with:- Application title and logo
- Current session ID
- Session info button
- Navigation breadcrumbs
Integration Points
PyTorch Integration
The platform integrates tightly with PyTorch for all ML operations: Model Building →app/models/pytorch/
- Custom CNN from layer configuration
- Transfer learning with pre-trained models (VGG, ResNet, EfficientNet)
- Vision Transformers with patch embeddings
app/training/dataset.py:129-249
MalwareDataset- Custom PyTorch Dataset- Automatic train/val/test splitting
- Weighted sampling for imbalanced classes
- Data augmentation pipeline
app/training/engine.py:13-306
TrainingEngine- Core training loop- Callbacks for checkpointing and metrics
- Early stopping support
- Learning rate scheduling
File System Integration
Session Persistence →app/state/persistence.py
app/utils/checkpoint_manager.py
Performance Considerations
Caching Strategy
The platform uses Streamlit’s caching decorators to optimize performance: Data Caching -@st.cache_data(ttl=300)
- Dataset scanning (expensive directory traversal)
- Image loading and preprocessing
- Visualization generation
@st.cache_resource
- Trained model loading (singleton)
- Large data structures
- Database connections
.md/arch.md:405-429 for complete patterns.
GPU Memory Management
- Automatic device detection (CUDA > MPS > CPU)
- Batch size configuration based on available memory
- Model parameter counting before training
- Memory monitoring in sidebar
Security & Isolation
Session Isolation
Each user session is isolated with:- Unique session ID (UUID4)
- Separate file storage directory
- Independent session state
- Isolated experiment tracking
Thread Safety
Background training threads are isolated from UI thread:- No shared memory access (uses file I/O)
- Thread registry for pause/stop control
- Daemon threads (auto-cleanup on exit)
app/training/worker.py:24-26 for implementation.
Extensibility
Adding New Model Architectures
- Create new file in
app/models/pytorch/ - Inherit from
BaseModel - Implement
build()andget_parameters_count() - Register in
worker.py:build_model()
Adding New Pages
- Create folder in
content/withpage.pyandview.py - For complex pages, add
tabs/subfolder - Register in
main.pynavigation
Technology Stack
Frontend
- Streamlit - Web UI framework
- Plotly - Interactive visualizations
- Pillow - Image processing
Backend
- PyTorch - Deep learning framework
- scikit-learn - Data splitting & metrics
- NumPy - Numerical operations
Models
- torchvision - Pre-trained models
- Custom CNN - Layer stack builder
- Vision Transformer - From scratch implementation
Infrastructure
- Threading - Background training
- JSON - Configuration persistence
- pathlib - File system operations
References
- Complete architecture documentation:
app/.md/arch.md - Model implementations:
app/models/ - Training pipeline:
app/training/ - State management:
app/state/