I built RansomShield, a Python prototype ransomware detection system for a hackathon demo. It lives in a GitHub repo under my handle @AnshuKumari09 and focuses on a single isolated folder (demo/) that contains the sub‑folders Protected, Backup, Canary, Logs and Quarantine.
The repository was started in October 2026 and last updated in the same month.
The first start creates demo/ (Protected, Backup, Canary, Logs, Quarantine) with sample files, three decoy canary files and a first safe snapshot.
A normal edit (click 1. Edit a file normally) raises the detection score by 1 point, keeping the system status SAFE.
A simulated attack (click 2. Launch simulated attack) triggers the alert within ~1.5 s, pushes the score past the 10‑point threshold, and the UI shows THREAT DETECTED.
When the threshold is crossed the system flips to THREAT CONTAINED, killing the simulator process and setting the demo folder read‑only.
Recovering (click 3. Recover files) restores files from the last safe snapshot, moves *.locked files to demo/Quarantine/, and the SHA‑256 check passes, resulting in status FILES RECOVERED.
- Signals and point values used by the scoring model:
- Distinct file changed in 6 s window – 1 point each (mass modification)
- File rewritten to high entropy (≥7.0 bits/byte and +1.5 vs snapshot) – 3 points each
- File renamed to a different extension – 3 points each
- Canary file modified / renamed / deleted – 10 points (instant alert)
Tests run with
pytest -q; the attack test takes a few seconds, the auto‑snapshot test ~7 s.
Future work includes scaling detection beyond a single folder, integrating OS‑level attribution (ETW/eBPF/minifilter), handling legitimate high‑entropy files, and persisting snapshots across restarts.
- Detection threshold: score ≥ 10 or any canary touch.
- Containment actions: kill the offending process, set the demo folder read‑only.
- Recovery actions: restore the latest safe snapshot, move suspicious files to
Quarantine, verify integrity via SHA‑256.