golang-detect-ransomfile

This is the project to build an anti ransomware apps that could protect every OS important files NEW UPDATED : ON PROGRESS DETECTOR FOR WINDOWS VERSION works on all windows system desktop or server Phase 1 Project :

building simple detector based on blacklist and whitelist process that will be filtered by detector go script

Update Progress : Completed Phase 1 Project

how to use (protector):

1. copy all files into any path as you want,
2. requirement golang-go with minimum 1.16.x version
3. make sure golang running, check with : go version
4. inside the project path : change e-mail address and subject e-mail as you want, or "/etc" path or any important system path
5. save file, change / clean whitelist.json and blacklist.json and replace with empty array json : []
6. go mod init "app_name"
7. go mod tidy
8. first time : go run detectup.go
9. open second console SSH : cd /etc && touch test.txt && mv test.txt test2.txt
10. stop go run detectup.go ( CTRL + C )
11. edit blacklist.json clean up again with []
12. edit whitelist.json add or edit the process as you desire that eligible or safe for the server
13. go build
14. for background process : nohup ./"app_name"
15. close SSH session
16. done - the protector will always detect any change especially mv or changes in /etc or any core file system

how to simulate ransomware (maskingfile) :

1. copy maskingfile.go to different path
2. go mod init v1 or other app name
3. go mod tidy
4. go build
5. touch /etc/test123.txt
6. run v1 or appname
7. this process should be killed by detectup if the detectup already running

Phase 2 Project : create API for pooling all protector services in all servers create UI in php/html for monitoring status protector fix update : detection.json for event monitoring

Phase 3 Project : using Machine Learning to analyze process that could be hazardous for systems create AI to memorize events and preventing infectious programs.