SUSPICIOUS

XenIroh

Static analysis and explainable threat detection for downloaded files and attachments

01 — SUMMARY OF FINDINGS

XenIroh is an academic cybersecurity application that watches a user's machine for newly arrived files — downloads, attachments, anything landing on disk — and inspects each one without ever executing it. Every file is read, never run.

(click the blacked-out line to declassify)

Where most tools stop at a bare confidence percentage, XenIroh is built to explain itself: what evidence was found, what reasoning was applied to it, and why that reasoning led to a particular verdict.

02 — CHAIN OF CUSTODY (ARCHITECTURE)

Static Analysis ──┐ Background Watcher ──┤──▶ Evidence ──▶ AI Reasoning ──▶ Explainable Verdict Manual Analyzer ──┘ (Search · Logic · Probability)

The investigative principle is kept strict throughout: the collection layer only ever asks "what happened?" The reasoning layer is the only part of the system allowed to ask "what does it mean?"

03 — EVIDENCE COLLECTED

File structure

Hashes, PE imports, section entropy, embedded macros, PDF scripts

Suspicious strings

Script/shell indicators surfaced as raw evidence, not a verdict

Image forensics

EXIF, trailing data past EOF markers, LSB entropy indicators

Reasoning trail

Search, logic, and probability — syllabus algorithms, no external AI

04 — DISPOSITION

Every analyzed file resolves to one of three case outcomes:

SUSPICIOUS LIKELY SAFE INCONCLUSIVE