A privacy-first take on local malware analysis
Summary
This article examines Burnyard, a privacy-first malware analysis system that keeps suspicious files local instead of uploading them to public repositories. The project runs binaries through user-space emulation, captures system and API calls, and uses a classifier to label samples across 43 malware families plus benign files. It reports faster analysis times than VirusTotal and Sophos Intelix in its test set, especially for Linux samples. The article also notes important limitations, including incomplete verdict validation and the possibility that malware can detect the stripped-down emulation environment. The underlying theme is a local, air-gapped analysis approach for security teams that need to avoid exposing sensitive samples to third-party services.