README.md

<SIMPLE ANTI-MALWARE USING SIGNATURE-BASED DETECTION>

Table of Contents

• About the Project
  • Built With
• Installation
• Contributers

About The Project

A simple command-line program simulating anti-malware with signature based technique.

OP 1: Get The Hash Value of a Specific File

• Given a string representing the path to a file in the system.
• The program checks if the input string is a real path to a real file in the system.
• If the checks fail, the input is considered invalid.
• If the checks passed, the program returns the SHA-256 digest for the file identified by input path.

OP 2: Add a SHA-256 Signature to The Database

• Given an input string representing a SHA-256 digest.
• The program removes spaces if any from the input string.
• The program calculates the length of the resulting string.
• If the length is not equal to 64, then the input is considered invalid.
• If the length is equal to 64, the resulting string is added to the signatures database.
• If the resulting string already exists in the database, the database will return an error indicating that the UNIQUE constraint is violated.
• If the resulting string doesn't exist in the database, then it is added successfully to the database.

OP 3: Delete a Signature from The Database

• Given an input string representing a SHA-256 digest.
• The database applies delete operation to the matching signature.

OP 4: Mark a File As a Virus

• Given a string representing the path to a file in the system.
• The program checks if the input string is a real path to a real file in the system.
• If the checks fail, the input is considered invalid.
• If the checks passed, the program calculates the SHA-256 digest for the file and store it in the database.

OP 5: Unmark a File from Being a Virus

• Given a string representing the path to a file in the system.
• The program checks if the input string is a real path to a real file in the system.
• If the checks fail, the input is considered invalid.
• If the checks passed, the program calculates the SHA-256 digest for the file and delete the matching signature from the database.

OP 6: Scan The Processes of The System

• The program lists all the currently running processes in the system.
• The program identifies the executable behind each process.
• The program calculates the SHA-256 digest for each executable.
• For each SHA-256 digest produced, the database checks if there is a matching signature stored in it.
• If there isn't a matching signature, then the executable is declared clean.
• If there is a matching signature, then the executable is declared malicious and the corresponding process is terminated.
• If the executable is malicious, the program removes the execution permission from it prventing it from being executed.
• At the end of the scanning process, a scanning summary appears.
• The summary includes:
  1. Total number of the programs scanned.
  2. Number of clean programs.
  3. Number of malicious programs detected.
  4. Number of malicious programs terminated.
  5. Number of malicious programs not terminated.
  6. Number of malicious programs prevented from being executed.
  7. Number of malicious programs not prevented from being executed.
• If there are malicious programs, the program will ask if the user wants to have those programs deleted.
• If the user wants to have those programs deleted, the program will attempt to delete them and tell the user which of them has been deleted successfully and which of them has not.
• If the user wants to keep those programs, the program won't attempt to delete them.

OP 7: Scan a Certain File

• Given a string representing the path to a file in the system.
• The program checks if the input string is a real path to a real file in the system.
• If the checks fail, the input is considered invalid.
• If the checks passed, the program calculates the SHA-256 digest for the file and check if there is a matching signature in the database.
• If there isn't a matching signature, then the file is declared clean.
• If there is a matching signature, then the file is declared malicious.
• For each malicious file, the program checks if there are any currently running processes run by that file.
• If there are processes run by that file, they are terminated.
• If the file is malicious, the program removes the execution permission from it prventing it from being executed.
• If the file is malicious, the program will ask if the user wants to have that file deleted.
• If the user wants to have that file deleted, the program will attempt to delete file and tell the user if the deletion attempt has been a success or not.
• If the user wants to keep that file, the program won't attempt to delete it.

OP 8: Scan a Certain Directory (Recursively For All Sub-Directories)

• Given a string representing the path to a directory in the system.
• The program checks if the input string is a real path to a real directory in the system.
• If the checks fail, the input is considered invalid.
• If the checks passed, the program first obtains all files in that directory and all sub-directories.
• For each file in that list, the program calculates its SHA-256 digest and checks if there is a matching with the signatures in the database.
• If there isn't a matching signature, then the file is declared clean.
• If there is a matching signature, then the file is declared malicious.
• For each malicious file, the program checks if there are any currently running processes run by that file.
• If the file is malicious, the program removes the execution permission from it prventing it from being executed.
• If there are processes run by that file, they are terminated.
• At the end of the scanning process, a scanning summary appears.
• The summary includes:
  1. Total number of the files scanned.
  2. Number of clean files.
  3. Number of malicious files detected.
  4. Number of malicious files having currently-running processes.
  5. Number of malicious files having no currently-running processes.
  6. Number of malicious files having their currently-running processes terminated.
  7. Number of malicious files having their currently-running processes not terminated.
  8. Number of malicious files prevented from being executed.
  9. Number of malicious files not prevented from being executed.
• If there are malicious files, the program will ask if the user wants to have those files deleted.
• If the user wants to have those programs deleted, the program will attempt to delete them and tell the user which of them has been deleted successfully and which of them has not.
• If the user wants to keep those files, the program won't attempt to delete them.

OP 9: Scan The Newly Created / Modified Files Within The Past X Minutes

• Given a string representing the path to a directory in the system.
• The program checks if the input string is a real path to a real directory in the system.
• If the checks fail, the input is considered invalid.
• If the checks passed, the program asks the user about how much time passed since the file is created of last modified to be considered new.
• The user replies specifying the number of minutes.
• The input specified by the user should be a positive numerical value which can either be an integer such as 5 or a floating-point value such as 0.5 or 3.5 and so on.
• Use floating-point values to represent number of minutes along with fractions of the minute (seconds)
• Let us suppose the user input is x minutes. (x can be either integer of floating-point number)
• The program lists all the files that are created or last-modified in the past x minutes.
• For each file in the list, the program calculates the SHA-256 digest and compare it with the signatures stored in the database.
• If there is no match, the file is declared clean.
• If there is a match, the file is declared malicious.
• For each malicious file, the program checks if there are any currently running processes run by that file.
• If there are processes run by that file, they are terminated.
• If the file is malicious, the program removes the execution permission from it prventing it from being executed.
• At the end of the scanning process, a scanning summary appears.
• The summary includes:
  1. Total number of the files scanned.
  2. Number of clean files.
  3. Number of malicious files detected.
  4. Number of malicious files having currently-running processes.
  5. Number of malicious files having no currently-running processes.
  6. Number of malicious files having their currently-running processes terminated.
  7. Number of malicious files having their currently-running processes not terminated.
  8. Number of malicious files prevented from being executed.
  9. Number of malicious files not prevented from being executed.
• If there are malicious files, the program will ask if the user wants to have those files deleted.
• If the user wants to have those programs deleted, the program will attempt to delete them and tell the user which of them has been deleted successfully and which of them has not.
• If the user wants to keep those files, the program won't attempt to delete them.

OP 10: Monitor and Scan New Files As Soon As They Are Created

• The user specifies the directory which he/she wants to monitor.
• As soon as a new file appears, the program waits until there are no other processes using that file.
• The program scans the file.
• If the file is malicious, the program declares the file to be malicious
• For each malicious file, terminate the processes which are run by that file (if any).
• If the file is malicious, the program removes the execution permission from it prventing it from being executed.
• If the file is clean, the program declares the file to be clean.
• At the end of the scanning process, a scanning summary appears.
• The summary includes:
  1. Total number of the files scanned.
  2. Number of clean files.
  3. Number of malicious files detected.
  4. Number of malicious files having currently-running processes.
  5. Number of malicious files having no currently-running processes.
  6. Number of malicious files having their currently-running processes terminated.
  7. Number of malicious files having their currently-running processes not terminated.
  8. Number of malicious files prevented from being executed.
  9. Number of malicious files not prevented from being executed.
• If there are malicious files, the program will ask if the user wants to have those files deleted.
• If the user wants to have those programs deleted, the program will attempt to delete them and tell the user which of them has been deleted successfully and which of them has not.
• If the user wants to keep those files, the program won't attempt to delete them.

OP 11: Load signatures from the online server

• The program connects to a server and obtains the signatures stored in the server's database.
• The program adds those signatures to its database.
• If there is a signature that is already in the program's database, the program skips it.

OP 12: Send signatures to the online server

• The program obtains the signatures stored in its database.
• The program connects to a server and sends those signatures to it.
• The server receives the sent signatures, and adds them to its database.
• If there is a signature that is already in the server's database, the server skips it.

OP 13: Exit

• The program breaks the while loop and exits.
• When the program exits, an exit handling function is executed printing the message Bye!

Built With

The program is mainly built with Python 3.6.9 and SQLite 3 on Ubuntu 18.04.6 LTS

Installation

1. Clone this repository

  git clone <repo_link>
  cd <repo>

2. Install the required packages

  pip install -r requirements.txt

3. Deploy the server or run it locally. Note: You'll have to add any string of your choice as an environment variable with the name "API_KEY" whether on the deployment platform or in your local system. You can run the server locally using

  cd Server
  python run.py

5. Add the server's URL to the Virus_Scanner.py in the variable "API" in line 20

6. Add the same string you chose to be an api key for the server to the Virus_Scanner.py in the variable "KEY" in line 21.

7. Build the scanner into an executable

  cd scanner
  pyinstaller --onefile Virus_Scanner.py connect_to_api.py
  cd dist
  sudo ./Virus_Scanner

8. Build the virus into an executable

  cd virus
  pyinstaller --onefile virus.py
  cd dist
  ./virus

Contributers