MemScan-EDR v2.0

AI-Powered Memory Threat Detection Engine with 3-Layer Detection Pipeline

MemScan-EDR v2.0 fully refactors the threat detection logic: 40-dimensional memory feature vector + unsupervised baseline detection + supervised classifier + MITRE ATT&CK rule engine in a 3-layer pipeline, significantly reducing false positives and improving scan speed. Built with C# WPF, packaged as a single .exe.

v2.0 Key Improvements

Dimension	v1.0	v2.0
Scan Method	Per-region signature matching	Prefilter → Feature extraction → 3-layer AI
Features	Simple (sig/protect/type)	40-dim (metadata + perms + code + entropy + network + DLL)
Unsupervised	None	4-class process baseline (Z-score + reconstruction error)
False Positives	System prompt constraints	JIT/AV/scripting engine whitelist corrections
Speed	O(regions x signatures)	80% prefilters skipped, only 20% enter AI pipeline

Features

Capability	Description
40-Dim Feature Extraction	Memory page permissions, PE integrity, Shannon entropy, suspicious APIs/strings, network behavior, DLL loading chain
3-Layer Detection	Layer 1: Unsupervised baseline → Layer 2: Supervised classifier → Layer 3: MITRE ATT&CK rules
Process Hollowing Detection	Memory PE header vs disk file comparison
Shannon Entropy Analysis	Identify encrypted/compressed payloads (high entropy > 7.0)
15 MITRE Rules	T1055 injection, T1055.012 hollowing, T1003 credential dump, T1496 mining, T1486 ransomware, etc.
15 Built-in Signatures	NOP sled, CobaltStrike, Meterpreter, Mimikatz, ReflectiveLoader, etc.
Smart FP Correction	JIT runtimes (.NET/Java/Node.js), security software, scripting engines (PowerShell), dev tools
Scan Modes	Fast (metadata) / Balanced (sampled) / Deep (full memory)
LLM Assist	Optional LLM second opinion for suspicious processes
Chinese/English UI	One-click language toggle

3-Layer Detection Pipeline

[Fast Prefilter] → Skip >80% signed safe processes
    ↓
[Layer 1: Baseline Anomaly] → 40-dim Z-score + reconstruction error
    ↓  Matches baseline → Safe
[Layer 2: Supervised Classifier] → Weighted linear model + decision tree
    ↓  Benign + low anomaly → Safe
[Layer 3: MITRE Rule Review] → 15 memory attack rules + FP corrections
    ↓  AI + Baseline + Rules cross-validation → Final verdict

Architecture

Models:
  MemoryFeatures    ── 40-dim AI feature vector
  BaselineProfile   ── Normal process baselines (4 classes)
  ProcessInfo       ── Process metadata + network + memory regions

Services:
  FeatureExtractor  ── Extract all-dimensional features from process memory
  EntropyAnalyzer   ── Shannon entropy calculation (sampling optimized)
  PEHeaderAnalyzer  ── PE integrity verification + Hollowing detection
  BaselineEngine    ── Unsupervised baseline anomaly detection
  ClassificationEngine ── Supervised classifier (weighted + decision tree)
  RuleEngine        ── 15 MITRE ATT&CK memory attack rules
  DetectionPipeline ── 3-layer orchestration engine
  AIAnalyzer        ── Pipeline integration + LLM assist
  MemoryScanner     ── Real byte matching + on-demand scanning
  ProcessCollector  ── Process enumeration + module listing

Quick Start

Prerequisites

Windows 10 / 11 (x64)
.NET 8 SDK
Administrator privileges (for memory scanning)

Build

git clone https://github.com/Huang-158/MemScan-EDR.git
cd MemScan-EDR

dotnet publish src-csharp/MemScanEDR/MemScanEDR.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish

.\publish\MemScan-EDR.exe

Disclaimer

This tool is intended for legitimate security research, education, and authorized security assessments only. Unauthorized use is illegal. Users are responsible for complying with all applicable laws.

License

MIT License — see LICENSE.

4.5 KiB Raw Permalink Blame History