[![中文](https://img.shields.io/badge/中文-README.md-red?style=flat-square&logo=markdown)](README.md)
# MemScan-EDR v2.0 > **AI-Powered Memory Threat Detection Engine with 3-Layer Detection Pipeline** [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) [![.NET 8](https://img.shields.io/badge/.NET-8.0-purple.svg)](https://dotnet.microsoft.com/) [![Platform: Windows](https://img.shields.io/badge/Platform-Windows%2010%2F11-lightgrey.svg)](https://www.microsoft.com/windows) MemScan-EDR v2.0 fully refactors the threat detection logic: **40-dimensional memory feature vector + unsupervised baseline detection + supervised classifier + MITRE ATT&CK rule engine** in a 3-layer pipeline, significantly reducing false positives and improving scan speed. Built with C# WPF, packaged as a single `.exe`. --- ## v2.0 Key Improvements | Dimension | v1.0 | v2.0 | |-----------|------|------| | **Scan Method** | Per-region signature matching | Prefilter → Feature extraction → 3-layer AI | | **Features** | Simple (sig/protect/type) | **40-dim** (metadata + perms + code + entropy + network + DLL) | | **Unsupervised** | None | **4-class process baseline** (Z-score + reconstruction error) | | **False Positives** | System prompt constraints | **JIT/AV/scripting engine** whitelist corrections | | **Speed** | O(regions x signatures) | **80% prefilters skipped**, only 20% enter AI pipeline | --- ## Features | Capability | Description | |---|---| | **40-Dim Feature Extraction** | Memory page permissions, PE integrity, Shannon entropy, suspicious APIs/strings, network behavior, DLL loading chain | | **3-Layer Detection** | Layer 1: Unsupervised baseline → Layer 2: Supervised classifier → Layer 3: MITRE ATT&CK rules | | **Process Hollowing Detection** | Memory PE header vs disk file comparison | | **Shannon Entropy Analysis** | Identify encrypted/compressed payloads (high entropy > 7.0) | | **15 MITRE Rules** | T1055 injection, T1055.012 hollowing, T1003 credential dump, T1496 mining, T1486 ransomware, etc. | | **15 Built-in Signatures** | NOP sled, CobaltStrike, Meterpreter, Mimikatz, ReflectiveLoader, etc. | | **Smart FP Correction** | JIT runtimes (.NET/Java/Node.js), security software, scripting engines (PowerShell), dev tools | | **Scan Modes** | Fast (metadata) / Balanced (sampled) / Deep (full memory) | | **LLM Assist** | Optional LLM second opinion for suspicious processes | | **Chinese/English UI** | One-click language toggle | ### 3-Layer Detection Pipeline ``` [Fast Prefilter] → Skip >80% signed safe processes ↓ [Layer 1: Baseline Anomaly] → 40-dim Z-score + reconstruction error ↓ Matches baseline → Safe [Layer 2: Supervised Classifier] → Weighted linear model + decision tree ↓ Benign + low anomaly → Safe [Layer 3: MITRE Rule Review] → 15 memory attack rules + FP corrections ↓ AI + Baseline + Rules cross-validation → Final verdict ``` --- ## Architecture ``` Models: MemoryFeatures ── 40-dim AI feature vector BaselineProfile ── Normal process baselines (4 classes) ProcessInfo ── Process metadata + network + memory regions Services: FeatureExtractor ── Extract all-dimensional features from process memory EntropyAnalyzer ── Shannon entropy calculation (sampling optimized) PEHeaderAnalyzer ── PE integrity verification + Hollowing detection BaselineEngine ── Unsupervised baseline anomaly detection ClassificationEngine ── Supervised classifier (weighted + decision tree) RuleEngine ── 15 MITRE ATT&CK memory attack rules DetectionPipeline ── 3-layer orchestration engine AIAnalyzer ── Pipeline integration + LLM assist MemoryScanner ── Real byte matching + on-demand scanning ProcessCollector ── Process enumeration + module listing ``` --- ## Quick Start ### Prerequisites - Windows 10 / 11 (x64) - [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0) - Administrator privileges (for memory scanning) ### Build ```powershell git clone https://github.com/Huang-158/MemScan-EDR.git cd MemScan-EDR dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish .\publish\MemScan-EDR.exe ``` --- ## Disclaimer > This tool is intended for **legitimate security research, education, and authorized security assessments only**. Unauthorized use is illegal. Users are responsible for complying with all applicable laws. --- ## License MIT License — see [LICENSE](LICENSE).