MemScan-EDR v2.0

AI-Powered Memory Threat Detection Engine with 3-Layer Detection Pipeline

MemScan-EDR v2.0 fully refactors the threat detection logic: 40-dimensional memory feature vector + unsupervised baseline detection + supervised classifier + MITRE ATT&CK rule engine in a 3-layer pipeline, significantly reducing false positives and improving scan speed. Built with C# WPF, packaged as a single .exe.

---

v2.0 Key Improvements

Dimension	v1.0	v2.0
Scan Method	Per-region signature matching	Prefilter → Feature extraction → 3-layer AI
Features	Simple (sig/protect/type)	40-dim (metadata + perms + code + entropy + network + DLL)
Unsupervised	None	4-class process baseline (Z-score + reconstruction error)
False Positives	System prompt constraints	JIT/AV/scripting engine whitelist corrections
Speed	O(regions x signatures)	80% prefilters skipped, only 20% enter AI pipeline

---

Features

Capability	Description
40-Dim Feature Extraction	Memory page permissions, PE integrity, Shannon entropy, suspicious APIs/strings, network behavior, DLL loading chain
3-Layer Detection	Layer 1: Unsupervised baseline → Layer 2: Supervised classifier → Layer 3: MITRE ATT&CK rules
Process Hollowing Detection	Memory PE header vs disk file comparison
Shannon Entropy Analysis	Identify encrypted/compressed payloads (high entropy > 7.0)
15 MITRE Rules	T1055 injection, T1055.012 hollowing, T1003 credential dump, T1496 mining, T1486 ransomware, etc.
15 Built-in Signatures	NOP sled, CobaltStrike, Meterpreter, Mimikatz, ReflectiveLoader, etc.
Smart FP Correction	JIT runtimes (.NET/Java/Node.js), security software, scripting engines (PowerShell), dev tools
Scan Modes	Fast (metadata) / Balanced (sampled) / Deep (full memory)
LLM Assist	Optional LLM second opinion for suspicious processes
Chinese/English UI	One-click language toggle

3-Layer Detection Pipeline

[Fast Prefilter] → Skip >80% signed safe processes
    ↓
[Layer 1: Baseline Anomaly] → 40-dim Z-score + reconstruction error
    ↓  Matches baseline → Safe
[Layer 2: Supervised Classifier] → Weighted linear model + decision tree
    ↓  Benign + low anomaly → Safe
[Layer 3: MITRE Rule Review] → 15 memory attack rules + FP corrections
    ↓  AI + Baseline + Rules cross-validation → Final verdict

---

Architecture

Models:
  MemoryFeatures    ── 40-dim AI feature vector
  BaselineProfile   ── Normal process baselines (4 classes)
  ProcessInfo       ── Process metadata + network + memory regions

Services:
  FeatureExtractor  ── Extract all-dimensional features from process memory
  EntropyAnalyzer   ── Shannon entropy calculation (sampling optimized)
  PEHeaderAnalyzer  ── PE integrity verification + Hollowing detection
  BaselineEngine    ── Unsupervised baseline anomaly detection
  ClassificationEngine ── Supervised classifier (weighted + decision tree)
  RuleEngine        ── 15 MITRE ATT&CK memory attack rules
  DetectionPipeline ── 3-layer orchestration engine
  AIAnalyzer        ── Pipeline integration + LLM assist
  MemoryScanner     ── Real byte matching + on-demand scanning
  ProcessCollector  ── Process enumeration + module listing

---

Quick Start

Prerequisites

• Windows 10 / 11 (x64)
• .NET 8 SDK
• Administrator privileges (for memory scanning)

Build

git clone https://github.com/Huang-158/MemScan-EDR.git
cd MemScan-EDR

dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish

.\publish\MemScan-EDR.exe

---

Disclaimer

This tool is intended for legitimate security research, education, and authorized security assessments only. Unauthorized use is illegal. Users are responsible for complying with all applicable laws.

---

License

MIT License — see LICENSE.