MATRIX: A Comprehensive Graph-Based Framework for Malware Analysis and Threat Research

Open Webpage

Marco Simoni, Andrea Saracino

Published: 2025, Last Modified: 06 Jan 2026SECRYPT 2025EveryoneRevisionsBibTeXCC BY-SA 4.0
Abstract: This paper presents MATRIX (Malware Analysis and Threat Research with STIX), a graph database for the comprehensive analysis and research of malware and threats. To provide a unified view of the threat landscape, MATRIX integrates data from major cybersecurity frameworks, including MITRE ATT&CK, DEF3ND, CAPEC, Malware Behavior Catalog (MBC), Metasploit, Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE). Developed in Neo4j using the Structured Threat Information Expression (STIX™) standard, MATRIX includes more than 22,910 nodes and combines 14 STIX Domain Objects (SDOs) and 6 STIX Relationship Objects (SROs) to provide a detailed analysis of malware behavior, detection rules and defense strategies, making it a valuable tool for cybersecurity research. The system also integrates real-world malware reports and is automatically updated with data from sources such as VirusTotal, Malware-Bazaar and VirusShare, supporting continuous and up-to-date threat anal