Graduation project · built with Omar Walid · 2025–26
Sentinel
Hybrid ML malware detection, from a Windows kernel minifilter to a hardened sandbox.
- 0.998
- ROC-AUC of the static model on the EMBER2024 test split
- 97.1%
- Malware caught at a 1% false-positive rate
- 0.982
- ROC-AUC of the behaviour model on sandbox reports
What we built
- A KMDF minifilter on the Windows Filter Manager that sends each file event's path and process ID to user mode over a filter communication port. It only observes, so the kernel side stays small and safe.
- A user-mode monitor that keeps .exe and .dll events, drops repeats within five seconds, and queues scan requests over a named pipe to a multi-threaded scanner.
- A PE parser and static features (headers, sections, imports, entropy, strings, YARA rules) scored by LightGBM, trained on the time-split EMBER2024 dataset after comparing five models.
- A CAPEv2 sandbox on patched QEMU/KVM that poses as a real laptop (CPUID, SMBIOS and ACPI tables, device names, hardware IDs) with a lived-in Windows guest, checked against al-khaser and pafish.
- Sentinel, a Python desktop app with a live kernel monitor, on-demand scans and exportable JSON reports.
How a file is checked
01 · Kernel
The minifilter sees a file created, opened or written and sends its path and process ID up a filter port.
02 · User mode
The monitor keeps .exe and .dll files, drops repeats within five seconds, and queues a scan over a named pipe.
03 · Static analysis
Worker threads parse the PE file and extract headers, sections, imports, entropy, strings and YARA matches.
04 · Machine learning
LightGBM scores the file. Benign files are allowed and logged.
05 · Sandbox
Suspicious files run in the hardened CAPEv2 sandbox, and a second model reads the behaviour report.
06 · Policy
The policy engine turns the final verdict into allow, warn or quarantine.
Screenshots
C / C++ / KMDF / WDK / Filter Manager / Named pipes / Python / LightGBM / EMBER2024 / YARA / CAPEv2 / QEMU/KVM / FastAPI / PyQt5
