以區塊鏈日誌記錄構建勒索軟件偵測系統

Developing Ransomware Detection System Using Blockchain Logging - My FYP Project

Being a Computer Science student from COMSATS University Islamabad, I always wanted my final year project to address a practical issue. We thought of developing a system that detects ransomware as well as maintains the logs using blockchain.

Here’s how I developed it.

❌The Problem

A common drawback of traditional anti-virus systems is that their functionality is based on the signature which can be bypassed by the ransomware very easily. In addition, after attacking any system, attackers can remove/delete/modify the system logs.

So, our project was about solving these two issues:

Detect ransomware behavior using Machine Learning
Ensure that the logging is secure and tamper proof

🔧Tech Stack Used

Frontend: Flutter
Backend: Python Flask/FastAPI
Database: SQLite
Machine Learning Model: Random Forest Classifier
Blockchain Logging: Custom blockchain based on SHA-256 hashing
API: REST APIs

🏗️ How It Works - Architecture

It is pretty straightforward yet highly effective:

1. Data Collection & Feature Extraction:
We analyze activity in the file system such as fast file encryption, extension change (.encrypted, .locked), entropy, etc., and also suspicious API calls.

2. ML Detection (Random Forest):
Random Forest machine learning was trained based on two classes – benign programs and ransomware. This particular algorithm was chosen because its accuracy equals 95%, has a few false positives and works fine with tabular data.

3. Alerting System:
In case ransomware was detected the following actions are taken:

The process is stopped.
Alert is delivered to the Flutter application.
Log is created.

4. Blockchain Logging:
This is the best part. In contrast to storing logs in the common database we use hashing of the log files with SHA-256 algorithm with linking to the previous log's hash.

Block = { data, timestamp, previous_hash, current_hash }

Any attempt to change the previous block will cause breaking the hash chain. Hence, logs are immutable.

💻 A Quick Code Snippet (Blockchain Log)


python
import hashlib
import time

def generate_hash(message, previousHash):
    block_string = f"{message}{time.time()}{previousHash}"
    return hashlib.sha256(block_string.encode()).hexdigest()

# Generating a safe log
log_message = "Ransomware detected: PID 4042"
previous_hash = "0000abc..."
safe_hash = generate_hash(log_message, previous_hash)
print(f"Safe Log: {safe_hash}")

🎯 Achievements 
1.Accuracy in Detection: ≈94-96% on test data
2.Alerting Real-time alerts within <2 secs
3.Logs are completely tamper proof and are verifiable


Challenges | Faced
1.Finding a pure dataset of ransomware behavior was difficult.
2.Find a balance between false positives and alerts.
3.To make blockchain lightweight to not affect performance.

Conclusion
Through this project, I have realized that Cybersecurity is not only about coding but about thinking like a hacker as well. The combination of AI + Blockchain provided me with a different viewpoint.

If you are working on a similar Final Year Project or looking for the GitHub Code, then let’s connect!

*About the Author*

My name is Anoshay Ambar. I have graduated in Computer Science from COMSATS University Islamabad. I love cybersecurity, AI, and health tech.

Let’s get connected through: [LinkedIn](https://www.linkedin.com/in/anoshay-ambar-174011397) | Email: anoshayambar@gmail.com