SentinelChain
A dual-tier ransomware detection system that monitors file system operations, measures real-time Shannon entropy spikes indicative of unauthorized encryption, and commits immutable audit logs to a tamper-proof blockchain ledger.
Detection Mechanics & Blockchain Ledger
Conventional signature-based antivirus solutions routinely fail against novel, polymorphic ransomware payloads. SentinelChain addresses this challenge through behavioral heuristics and cryptographic verification:
Shannon Entropy Analysis
Computes real-time byte entropy of modified files. Plaintext documents typically exhibit entropy between 3.5 and 5.0, whereas encrypted blocks spike toward 7.9+. Sudden high-entropy write spikes trigger immediate alert thresholds.
Append-Only Blockchain Ledger
File modification events and SHA-256 block hashes are recorded into a cryptographic blockchain. Adversaries attempting to alter historical logs cannot rewrite previous block hashes without invalidating the entire chain.
Lightweight Agent Watcher
A background Python daemon utilizing low-overhead kernel event hooks (watchdog) to monitor designated directory trees without introducing I/O latency to standard user workflows.
Automated Containment
When anomalous bulk encryption is detected within a designated time window, the agent issues an emergency kill signal to the suspicious process ID, isolating the infection vector.