File_Integrity_Monitor - A Python-based defensive security tool that monito

项目说明

File Integrity Monitoring System (FIM)

A Python-based defensi tool that detects unauthorized file changes using cryptographic hashing, baseline comparison, and automated security reporting.

This project demonstrates practical cybersecurity concepts used in Security Operations (SOC), Endpoint Security, Incident Response, and Security Automation.

---

Cybersecurity Focus Areas

Security Operations Center (SOC)

Endpoint Security

Threat Detection

Incident Response

Security Automation

Defensi

---

Project O

File Integrity Monitoring (FIM) is a security capability used to identify unauthorized changes to important files, configurations, and system resources.

Unexpected file changes can indicate:

Malware activity

Unauthorized modifications

Insider threats

Configuration tampering

Possible security compromise

This project implements a lightweight File Integrity Monitoring engine that:
1. Creates a trusted baseline of monitored files using SHA-256 cryptographic hashes and metadata.
2. Scans directories and compares current file states against the trusted baseline.
3. Detects modified, newly created, and deleted files.
4. Classifies security events based on se.
5. Generates in reports in JSON, CSV, and text formats.

---

Features

File Integrity Monitoring

SHA-256 cryptographic hashing

Recursi scanning

File metadata collection

Baseline creation and

Detection of file modifications

Detection of new files

Detection of deleted files

---

Security Detection

The system identifies:

Unauthorized file modifications

Suspicious executable creation

Configuration changes

Missing critical files

Multiple file changes during a single scan

---

Security Alerting

Events are classified into:
| Se | Description |
|----------|-------------|
| LOW | Expected or low-risk changes |
| MEDIUM | Suspicious file activity requiring review |
| HIGH | Potential security incident |
| CRITICAL | Indicators of possible compromise |

---

Reporting

Generates:

JSON security reports

CS reports

Human-readable incident summaries

Audit logs

---

Technologies Used

Python 3

SHA-256 Hashing

JSON

CSV

argparse

pathlib

hashlib

Python Logging Module

---

Installation

Requires Python 3.10+ (uses modern type-hint syntax).

---

Usage

Create the trusted baseline (run this first, and again any time changes
are re and approved):

Run a single integrity scan against the baseline:

Run a scan and generate JSON/CSV/text reports:

Continuously monitor the directory (polls on an inter in
config.json):

Target a different directory:

---

Example Output

See sample_output.txt for a full walkthrough
co four scenarios: a routine low-risk update, an unauthorized
sensiti change, a suspicious new executable, and a deleted
system configuration file — showing how each is classified LOW, HIGH,
CRITICAL, and CRITICAL respectively.

---

Security Concepts Demonstrated

Cryptographic integrity - Using SHA-256 hashing to detect unauthorized changes to files.

Endpoint security monitoring - Applying file monitoring concepts used in enterprise security en.

Digital forensics fundamentals - Creating trusted baselines and identifying changes from known-good states.

Threat detection & triage - Classifying security events based on risk and in priority.

MITRE ATT&CK mapping - connecting obser (data manipulation, indicator removal, autostart execution) to known ad techniques

Security automation - Automating repetiti monitoring and reporting tasks.

Audit logging - Maintaining records of security-relevant events for in.

---

Future Impro

Real-time monitoring using the watchdog library instead of polling

Risk-score calculation that blends se, asset sensitivity, and change frequency

SQLite-backed hash comparison history for longer-term trend analysis

HTML security dashboard report

Simulated email/webhook alert delivery

Digital signing of the baseline file to detect baseline tampering

Integration with a real SIEM (e.g. /CEF output)

---

Disclaimer

This is a defensi portfolio project built for educational and
demonstration purposes. suspicious_tool.exe referenced in the sample
walkthrough is a plain text placeholder file used only to demonstrate
detection logic - it contains no executable code and is not malware.

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Python-based defensive security tool that monitors file integrity, detects unauthorized changes, identifies suspicious activity, and generates security alerts to support SOC operations and incident response.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。