-
Notifications
You must be signed in to change notification settings - Fork 3
Project Overview
Hybrid R-Sentry is a ransomware detection and auto-containment system designed for Linux endpoints. It extends the academic paper R-Sentry by adding new detection layers and combining them into a unified real-time pipeline with an AI-powered analyst and live dashboard.
Unlike signature-based antivirus solutions, Hybrid R-Sentry uses behavioral analysis — it watches how processes interact with the filesystem and scores their activity against known ransomware patterns. This allows it to catch unknown and zero-day ransomware variants before they cause significant damage.
Traditional ransomware detection relies on:
- Signatures — only catches known malware
- Manual response — too slow when files are being encrypted in real time
Hybrid R-Sentry addresses this by:
- Detecting ransomware behavior (encryption, canary access, suspicious process chains, extension renames)
- Automatically containing the entire malicious process tree the moment a threat is detected
- Explaining the threat using AI so the analyst understands exactly what happened
| Capability | Description |
|---|---|
| Canary File Detection | Bait files trigger instant CRITICAL alert if touched or deleted |
| Entropy Analysis | Detects file encryption by measuring randomness increase (memory-capped, LRU) |
| Process Lineage Scoring | Scores suspicious process ancestry chains + dpkg binary hash verification |
| Ransomware Extension Detection | Renames to .enc, .locked, .wcry etc. fire CRITICAL or HIGH alerts |
| Markov Chain Repositioning | Adapts canary placement to predicted attack hotspots |
| eBPF Kernel Sensor | TRACEPOINT_PROBE rename syscall monitoring; velocity burst detection; ransomware family profiling (LockBit5/Akira/ESXi) — kernel 6.19+, BCC 0.35 |
| Tree-Aware Auto-Containment | Freezes and kills the entire malicious process tree automatically |
| AI Threat Classification | Multi-provider LLM explains each threat with type, technique, and recommendation |
| SIEM Dashboard | Kibana-style 3-column layout: FacetRail filter panel, stacked histogram, D3 force graph, alert flyout, PDF forensic export |
This project was built as a cybersecurity capstone running on Kali Linux. The system is designed to demonstrate how multiple detection signals can be fused into a single high-confidence threat score, reducing both false positives and response time.
| Layer | Technology |
|---|---|
| Agent (inotify) | Python 3.13, watchdog 6, psutil, networkx, numpy, scipy |
| Agent (eBPF) | Python 3.13, BCC 0.35 (python3-bpfcc), kernel 6.19+ — agent/monitor_ebpf.py
|
| Backend | FastAPI, SQLAlchemy async, PostgreSQL, asyncpg, Redis, Celery |
| AI | Cerebras / NVIDIA / Groq (OpenAI-compatible, multi-provider fallback) |
| Frontend | React 19, Vite 5, Tailwind CSS 3, D3 v7, Recharts, jsPDF, IBM Plex Sans/Mono, Font Awesome 6.5.1 |
| Infrastructure | Docker Compose (PostgreSQL + Redis), Node.js 22 |