-
Notifications
You must be signed in to change notification settings - Fork 3
Project Overview
Hybrid R-Sentry is a ransomware detection and auto-containment system designed for Linux endpoints. It extends the academic paper R-Sentry by adding new detection layers and combining them into a unified real-time pipeline with an AI-powered analyst and live dashboard.
Unlike signature-based antivirus solutions, Hybrid R-Sentry uses behavioral analysis — it watches how processes interact with the filesystem and scores their activity against known ransomware patterns. This allows it to catch unknown and zero-day ransomware variants before they cause significant damage.
Traditional ransomware detection relies on:
- Signatures — only catches known malware
- Manual response — too slow when files are being encrypted in real time
Hybrid R-Sentry addresses this by:
- Detecting ransomware behavior (encryption, canary access, suspicious process chains, extension renames)
- Automatically containing the entire malicious process tree the moment a threat is detected
- Explaining the threat using AI so the analyst understands exactly what happened
| Capability | Description |
|---|---|
| Canary File Detection | Bait files trigger instant CRITICAL alert if touched or deleted |
| Entropy Analysis | Detects file encryption by measuring randomness increase (memory-capped, LRU) |
| Process Lineage Scoring | Scores suspicious process ancestry chains + dpkg binary hash verification |
| Ransomware Extension Detection | Renames to .enc, .locked, .wcry etc. fire CRITICAL or HIGH alerts |
| Markov Chain Repositioning | Adapts canary placement to predicted attack hotspots |
| Tree-Aware Auto-Containment | Freezes and kills the entire malicious process tree automatically |
| AI Threat Classification | Multi-provider LLM explains each threat with type, technique, and recommendation |
| Live Dashboard | Real-time WebSocket feed with alerts, events, host risk, and PDF forensic export |
This project was built as a cybersecurity capstone running on Kali Linux. The system is designed to demonstrate how multiple detection signals can be fused into a single high-confidence threat score, reducing both false positives and response time.
| Layer | Technology |
|---|---|
| Agent | Python 3.13, watchdog, psutil, networkx, numpy, scipy |
| Backend | FastAPI, SQLAlchemy async, PostgreSQL, Redis, Celery |
| AI | Cerebras / NVIDIA / Groq (OpenAI-compatible, multi-provider fallback) |
| Frontend | React 18, Tailwind CSS, Recharts, jsPDF |
| Infrastructure | Docker Compose (PostgreSQL + Redis) |