Ransomware-Detection-and-Response-System - A defensive cybersecurity system for detecting ran

项目说明

Ransomware Detection & Response System (RDRS)

A modular Python-based ransomware detection and response system designed to monitor filesystem activity, analyze suspicious beha patterns, calculate threat scores, generate security alerts, preser e, and expose monitoring data through a REST API and li dashboard.

RDRS was de as part of a cybersecurity internship project with a focus on defensi monitoring, ransomware behavior detection, incident handling, e preser, and security engineering practices.

---

Current

v1.6.0

---

Project Status

Core implementation completed.

RDRS v1.6.0 represents the completed core project milestone, including filesystem monitoring, entropy analysis, beha analysis, weighted threat scoring, alert generation, e quarantine, REST API functionality, li monitoring, incident reporting, Docker deployment, and automated testing.

The project can now serve as a portfolio-ready defensi engineering project and as a foundation for future production-grade de.

---

Core Features

Detection

Threat Assessment

Incident Response

Li

REST API

RDRS provides REST API endpoints for:

Reporting

Deployment

---

Functional Requirements

| FR | Requirement | Status |
|----|-------------|--------|
| FR-1 | Filesystem monitoring foundation | ✅ Completed |
| FR-2 | File entropy analysis | ✅ Completed |
| FR-3 | Configurable detection thresholds | ✅ Completed |
| FR-4 | Process metadata collection | ✅ Completed |
| FR-5 | Initial incident handling | ✅ Completed |
| FR-6 | Sliding time-window analysis | ✅ Completed |
| FR-7 | Weighted threat scoring | ✅ Completed |
| FR-8 | Alert generation and incident records | ✅ Completed |
| FR-9 | E quarantine and SHA-256 | ✅ Completed |
| FR-10 | REST API endpoints | ✅ Completed |
| FR-11 | Li dashboard | ✅ Completed |
| FR-12 | JSON and CS reporting | ✅ Completed |
| FR-13 | Docker deployment and dependency cleanup | ✅ Completed |

---

Architecture

---

Project Structure

---

Detection Pipeline

RDRS processes filesystem activity through the following sequence:

---

Threat Scoring

RDRS uses an explainable weighted scoring model.

The final threat score is calculated from four beha components:

The default scoring configuration is:

Threat levels are classified as:

The configured detection threshold determines when an event is considered sufficiently suspicious to trigger alert generation.

---

E Preser

RDRS uses a safe e model.

When a suspicious file exceeds the configured threat threshold:

1. The original file is retained.
2. SHA-256 is calculated for the original file.
3. A timestamped quarantine directory is created.
4. The file is copied into the quarantine directory.
5. SHA-256 is calculated again for the copied e.
6. The two hashes are compared.
7. The e is considered successfully preserved only when the hashes match.

The original file is ne, deleted, or modified by the quarantine operation.

---

Database

RDRS uses SQLite for local persistence.

Historical incident records include:

RDRS also maintains a separate li record containing the current sliding-window detector state.

This separation allows historical incidents and current detector state to be displayed independently.

---

REST API

The RDRS REST API is implemented using Flask.

A endpoints include:

The API provides access to current detector state, historical incidents, quarantine e, configuration status, and the li dashboard.

---

Dashboard

RDRS provides a browser-based li dashboard.

The dashboard displays:

The dashboard communicates with the Flask REST API using browser-side API requests.

---

Reporting

RDRS supports incident report generation in:

Reports contain structured incident information including:

Reports are generated with timestamped filenames and stored in the configured report output directory.

---

Configuration

The main configuration file is:

Example configuration:

Configuration is loaded through:

---

Installation

Clone the repository:

Install dependencies:

---

Running RDRS

Start the main monitoring application:

RDRS will:

1. Load configuration.
2. Initialize the SQLite database.
3. Display the startup banner.
4. Start filesystem monitoring.
5. Analyze filesystem activity.
6. Calculate threat assessments.
7. Generate alerts for threshold-exceeding activity.
8. Preser e.

---

Running the REST API

Start the Flask REST API:

The API is a at:

The dashboard is a at:

---

Testing

RDRS includes automated tests co:

Run the test suite with:

Current test status:

---

Docker

RDRS includes Docker deployment support.

Build the image:

Run the container:

The REST API can then be accessed through:

---

Safety Notes

RDRS is designed as a defensi monitoring and detection project.

The quarantine component operates in simulation mode by default.

The system:

Testing should be performed only against files and directories that you are authorized to monitor.

---

Documentation

Additional project documentation is a in the docs/ directory:

---

De History

The project was de incrementally through functional requirements co the detection pipeline, incident response, reporting, API, dashboard, and deployment.

The completed functional requirements are documented in the project changelog and de journal.

See:

---

Information

Current application :

information is maintained in:

---

License

See:

for the project's licensing information.

---

Project Repository

GitHub:

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A defensive cybersecurity system for detecting ransomware-like behavior, analyzing threats, generating incidents and supporting security response.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。