114 lines
4.5 KiB
Markdown
114 lines
4.5 KiB
Markdown
<div align="right">
|
|
|
|
[](README.md)
|
|
|
|
</div>
|
|
|
|
# MemScan-EDR v2.0
|
|
|
|
> **AI-Powered Memory Threat Detection Engine with 3-Layer Detection Pipeline**
|
|
|
|
[](LICENSE)
|
|
[](https://dotnet.microsoft.com/)
|
|
[](https://www.microsoft.com/windows)
|
|
|
|
MemScan-EDR v2.0 fully refactors the threat detection logic: **40-dimensional memory feature vector + unsupervised baseline detection + supervised classifier + MITRE ATT&CK rule engine** in a 3-layer pipeline, significantly reducing false positives and improving scan speed. Built with C# WPF, packaged as a single `.exe`.
|
|
|
|
---
|
|
|
|
## v2.0 Key Improvements
|
|
|
|
| Dimension | v1.0 | v2.0 |
|
|
|-----------|------|------|
|
|
| **Scan Method** | Per-region signature matching | Prefilter → Feature extraction → 3-layer AI |
|
|
| **Features** | Simple (sig/protect/type) | **40-dim** (metadata + perms + code + entropy + network + DLL) |
|
|
| **Unsupervised** | None | **4-class process baseline** (Z-score + reconstruction error) |
|
|
| **False Positives** | System prompt constraints | **JIT/AV/scripting engine** whitelist corrections |
|
|
| **Speed** | O(regions x signatures) | **80% prefilters skipped**, only 20% enter AI pipeline |
|
|
|
|
---
|
|
|
|
## Features
|
|
|
|
| Capability | Description |
|
|
|---|---|
|
|
| **40-Dim Feature Extraction** | Memory page permissions, PE integrity, Shannon entropy, suspicious APIs/strings, network behavior, DLL loading chain |
|
|
| **3-Layer Detection** | Layer 1: Unsupervised baseline → Layer 2: Supervised classifier → Layer 3: MITRE ATT&CK rules |
|
|
| **Process Hollowing Detection** | Memory PE header vs disk file comparison |
|
|
| **Shannon Entropy Analysis** | Identify encrypted/compressed payloads (high entropy > 7.0) |
|
|
| **15 MITRE Rules** | T1055 injection, T1055.012 hollowing, T1003 credential dump, T1496 mining, T1486 ransomware, etc. |
|
|
| **15 Built-in Signatures** | NOP sled, CobaltStrike, Meterpreter, Mimikatz, ReflectiveLoader, etc. |
|
|
| **Smart FP Correction** | JIT runtimes (.NET/Java/Node.js), security software, scripting engines (PowerShell), dev tools |
|
|
| **Scan Modes** | Fast (metadata) / Balanced (sampled) / Deep (full memory) |
|
|
| **LLM Assist** | Optional LLM second opinion for suspicious processes |
|
|
| **Chinese/English UI** | One-click language toggle |
|
|
|
|
### 3-Layer Detection Pipeline
|
|
|
|
```
|
|
[Fast Prefilter] → Skip >80% signed safe processes
|
|
↓
|
|
[Layer 1: Baseline Anomaly] → 40-dim Z-score + reconstruction error
|
|
↓ Matches baseline → Safe
|
|
[Layer 2: Supervised Classifier] → Weighted linear model + decision tree
|
|
↓ Benign + low anomaly → Safe
|
|
[Layer 3: MITRE Rule Review] → 15 memory attack rules + FP corrections
|
|
↓ AI + Baseline + Rules cross-validation → Final verdict
|
|
```
|
|
|
|
---
|
|
|
|
## Architecture
|
|
|
|
```
|
|
Models:
|
|
MemoryFeatures ── 40-dim AI feature vector
|
|
BaselineProfile ── Normal process baselines (4 classes)
|
|
ProcessInfo ── Process metadata + network + memory regions
|
|
|
|
Services:
|
|
FeatureExtractor ── Extract all-dimensional features from process memory
|
|
EntropyAnalyzer ── Shannon entropy calculation (sampling optimized)
|
|
PEHeaderAnalyzer ── PE integrity verification + Hollowing detection
|
|
BaselineEngine ── Unsupervised baseline anomaly detection
|
|
ClassificationEngine ── Supervised classifier (weighted + decision tree)
|
|
RuleEngine ── 15 MITRE ATT&CK memory attack rules
|
|
DetectionPipeline ── 3-layer orchestration engine
|
|
AIAnalyzer ── Pipeline integration + LLM assist
|
|
MemoryScanner ── Real byte matching + on-demand scanning
|
|
ProcessCollector ── Process enumeration + module listing
|
|
```
|
|
|
|
---
|
|
|
|
## Quick Start
|
|
|
|
### Prerequisites
|
|
|
|
- Windows 10 / 11 (x64)
|
|
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
|
|
- Administrator privileges (for memory scanning)
|
|
|
|
### Build
|
|
|
|
```powershell
|
|
git clone https://github.com/Huang-158/MemScan-EDR.git
|
|
cd MemScan-EDR
|
|
|
|
dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish
|
|
|
|
.\publish\MemScan-EDR.exe
|
|
```
|
|
|
|
---
|
|
|
|
## Disclaimer
|
|
|
|
> This tool is intended for **legitimate security research, education, and authorized security assessments only**. Unauthorized use is illegal. Users are responsible for complying with all applicable laws.
|
|
|
|
---
|
|
|
|
## License
|
|
|
|
MIT License — see [LICENSE](LICENSE).
|