adityax26/ransomgaurd_ai

🛡️ RansomGuard AI: Complete System Overview

RansomGuard AI is a comprehensive, AI-powered ransomware detection and response system. From the second a rogue executable touches a single file to the moment it is killed and the admin is notified, the entire pipeline happens autonomously in less than 200 milliseconds.

Here is the complete A-to-Z breakdown of the system architecture:

1. The Real-Time File System Monitor (The Eyes)

At the lowest level, RansomGuard uses a highly optimized watchdog process that constantly monitors your designated "sandbox" (or protected) directory.

• —It tracks every single file operation: Create, Modify, Rename, and Delete.
• —It calculates the raw speed of these operations (e.g., 500 files modified per second).
• —It measures the exact amount of data being written to the disk in real time.

2. The Deception Engine (The Traps)

RansomGuard automatically deploys hidden "Honeypot" files throughout your system (e.g., _0_Financial_Report_2026.txt or a_passwords_backup.txt).

• —Because they start with characters like _ or 0, ransomware algorithms naturally target them first when sorting files alphabetically.
• —These files are completely invisible to normal users, meaning no legitimate program should ever touch them.
• —If any process modifies or deletes a honeypot, RansomGuard instantly triggers a critical, non-negotiable alert—bypassing all ML logic entirely.

3. The Forensic Feature Extractor (The Brain)

When a process starts heavily modifying files, RansomGuard doesn't just look at the speed; it analyzes the content of what is being written:

• —Shannon Entropy Analysis: It reads the math behind the files. Normal text files have low entropy (predictable patterns). Ransomware encrypts files into high-entropy, completely randomized data. If the engine sees a process rapidly turning low-entropy files into high-entropy gibberish, it knows encryption is happening.
• —Extension Tracking: It checks if the process is changing file extensions to known ransomware signatures (like .locked, .crypt, or .wncry).
• —Sequential Access: It analyzes if the process is iterating through files perfectly sequentially (a hallmark of automated scripts) versus randomly (how humans click things).

4. The Machine Learning Ensemble (The Judge)

RansomGuard doesn't rely on just one AI model; it runs a trio of specialized models trained on thousands of real-world ransomware attack vectors:

1. 1.Random Forest: Looks at complex, non-linear relationships between CPU usage, entropy, and file write speeds.
2. 2.XGBoost: A highly sensitive gradient-boosting model tuned to detect microscopic anomalies in disk I/O burst patterns.
3. 3.Isolation Forest: An unsupervised anomaly detection model. Even if a brand new, zero-day ransomware strain attacks that the AI has never seen before, this model will flag it simply because the behavior is "too weird" compared to normal system usage.

The system averages the scores from all three models to output a final Risk Score from 0% to 100%.

5. The Automated Responder (The Shield)

If the AI Ensemble or the Honeypots confirm an attack is happening, the automated incident responder immediately steps in:

• —Process Assassination: It uses OS-level APIs to identify the exact PID (Process ID) of the malware and instantly terminates it, stopping the encryption dead in its tracks.
• —Shadow Backups: Before the ransomware can finish encrypting the folder, RansomGuard rapidly copies the remaining unencrypted files into a secured, hidden backup directory so you don't lose your data.
• —Forensic Reporting: It automatically generates a comprehensive HTML incident report detailing the exact timeline of the attack, the signature matches, the CPU usage, and the file entropy charts.

6. The Alerting System (The Messenger)

Finally, it reaches out to the system administrator:

• —Live Dashboard: A beautiful, real-time web UI running on Flask and Socket.IO. It shows live charts of disk I/O, recent alerts, system health, and a feed of file operations. It uses a secure tunnel to expose this dashboard to the public internet so you can monitor your server remotely.
• —Smart Email Alerts: It dynamically routes a beautifully formatted email to the admin. The email translates the raw technical data into human-readable metrics (like "Percentage of Encrypted Files") and provides a dynamic "Recommended Next Steps" section, telling the admin exactly what to do based on whether the threat was classified as a full-blown RANSOMWARE attack or just SUSPICIOUS behavior.