MALSIS-CVE

Problem

Malware sandbox reports are noisy, unstructured logs. Connecting what a sample actually does to known attacker techniques or relevant CVEs is normally a manual, slow cross-referencing job for an analyst working under time pressure.

Approach

Built a pipeline that submits a sample to Cuckoo Sandbox, extracts the behavioral indicators from the resulting report, maps them against the MITRE ATT&CK Enterprise matrix, and ranks likely related CVEs using TF-IDF similarity against a local NVD dataset — then compiles all of it into a single readable HTML report.

Stack

• Python
• Cuckoo Sandbox API
• MITRE ATT&CK Enterprise dataset
• NVD CVE dataset
• scikit-learn
• Jinja2
• Requests

Outcome

Removes the manual correlation step from malware triage — an analyst gets a ranked, attacker-technique-aware view of a sample's likely CVE relationships in one pass instead of cross-referencing three separate sources by hand.