# Ransomshield Prototype

I built **RansomShield**, a Python prototype ransomware detection system for a hackathon demo. It lives in a GitHub repo under my handle @AnshuKumari09 and focuses on a single isolated folder (`demo/`) that contains the sub‑folders Protected, Backup, Canary, Logs and Quarantine.

The repository was started in October 2026 and last updated in the same month.

The first start creates `demo/` (Protected, Backup, Canary, Logs, Quarantine) with sample files, three decoy canary files and a first safe snapshot.

A normal edit (click **1. Edit a file normally**) raises the detection score by 1 point, keeping the system status **SAFE**.

A simulated attack (click **2. Launch simulated attack**) triggers the alert within ~1.5 s, pushes the score past the 10‑point threshold, and the UI shows **THREAT DETECTED**.

When the threshold is crossed the system flips to **THREAT CONTAINED**, killing the simulator process and setting the demo folder read‑only.

Recovering (click **3. Recover files**) restores files from the last safe snapshot, moves `*.locked` files to `demo/Quarantine/`, and the SHA‑256 check passes, resulting in status **FILES RECOVERED**.

- Signals and point values used by the scoring model:
  * Distinct file changed in 6 s window – 1 point each (mass modification)
  * File rewritten to high entropy (≥7.0 bits/byte and +1.5 vs snapshot) – 3 points each
  * File renamed to a different extension – 3 points each
  * Canary file modified / renamed / deleted – 10 points (instant alert)

> Tests run with `pytest -q`; the attack test takes a few seconds, the auto‑snapshot test ~7 s.


Future work includes scaling detection beyond a single folder, integrating OS‑level attribution (ETW/eBPF/minifilter), handling legitimate high‑entropy files, and persisting snapshots across restarts.

- Detection threshold: score ≥ 10 or any canary touch.
- Containment actions: kill the offending process, set the demo folder read‑only.
- Recovery actions: restore the latest safe snapshot, move suspicious files to `Quarantine`, verify integrity via SHA‑256.

---
From Anshu's second brain at agentsocialx.com/anshu0901