Author: Hem Sagar
Date: June 27, 2024
- Introduction
- Project Overview
- Features
- Installation
- Usage
- Testing
- Limitations
- Future Enhancements
- References
Purpose: The Malware Detection Program is designed to scan files and directories for malware infections using signature-based detection and VirusTotal API integration.
Scope: This project focuses on detecting known malware signatures and providing detailed reports. It does not cover heuristic or behavior-based detection.
Objective: To create a tool that can scan files for known malware signatures and check file hashes against the VirusTotal database.
Tools and Technologies: Python, YARA, VirusTotal API.
System Architecture:
- File selection module
- Hashing and signature comparison (YARA)
- VirusTotal API integration
- Output generation
- Scans files for known malware signatures using YARA rules.
- Checks file hashes against the VirusTotal database.
- Generates detailed scan reports.
Prerequisites:
- Python 3.x
- Required Python libraries (listed in
requirements.txt
)
Step-by-Step Installation Guide:
- Clone the repository:
git clone https://github.com/Hemsagar11/AegisShield.git
- Navigate to the project directory:
cd AegisShield
- Create and activate a virtual environment:
python -m venv venv source venv/bin/activate # Linux/macOS venv\Scripts\activate # Windows
- Install dependencies:
pip install -r requirements.txt
- Configure Environment Variables:
- Create a .env file inside the project directory.
- Set your API key & Yara rule path in the .env file as
VIRUSTOTAL_API_KEY= "Your API Key" YARA_RULES_PATH= path/to/yara-rules
Running the Program: To start the program, run:
python aegis_shield.py [Arguments]
Command-Line Arguments:
-d, --directory: Specify the directory to scan.
-f, --file: Specify a single file to scan.
--hash: Specify the hashing algorithm.
Example Usage:
python aegis_shield.py --directory /path/to/scan
python aegis_shield.py --file /path/to/file.exe
Note: To Exit the virtual isolated environment, run the command deactivate in the terminal.
Test Cases:
- Malware Samples: Scanned known malware samples to verify detection. Samples -> MalwareBazaar
- Clean Files: Ensured no false positives with clean files.
- Edge Cases: Tested with large files and various file types.
Test Results:
- Successfully detected all known malware samples.
- No false positives with clean files.
Known Issues:
- Detection limited to known signatures.
- VirusTotal API rate limits may affect performance.
Future Work:
- Implement heuristic analysis.
- Add machine learning-based detection.
Potential Features:
- Real-time file monitoring.
- Improved scanning algorithms.
- Enhanced user interface with a web dashboard.