Being a Computer Science student from COMSATS University Islamabad, I always wanted my final year project to address a practical issue. We thought of developing a system that detects ransomware as well as maintains the logs using blockchain.
Here’s how I developed it.
A common drawback of traditional anti-virus systems is that their functionality is based on the signature which can be bypassed by the ransomware very easily. In addition, after attacking any system, attackers can remove/delete/modify the system logs.
So, our project was about solving these two issues:
It is pretty straightforward yet highly effective:
1. Data Collection & Feature Extraction:
We analyze activity in the file system such as fast file encryption, extension change (.encrypted, .locked), entropy, etc., and also suspicious API calls.
2. ML Detection (Random Forest):
Random Forest machine learning was trained based on two classes – benign programs and ransomware. This particular algorithm was chosen because its accuracy equals 95%, has a few false positives and works fine with tabular data.
3. Alerting System:
In case ransomware was detected the following actions are taken:
4. Blockchain Logging:
This is the best part. In contrast to storing logs in the common database we use hashing of the log files with SHA-256 algorithm with linking to the previous log's hash.
Block = { data, timestamp, previous_hash, current_hash }
Any attempt to change the previous block will cause breaking the hash chain. Hence, logs are immutable.
python
import hashlib
import time
def generate_hash(message, previousHash):
block_string = f"{message}{time.time()}{previousHash}"
return hashlib.sha256(block_string.encode()).hexdigest()
log_message = "Ransomware detected: PID 4042"
previous_hash = "0000abc..."
safe_hash = generate_hash(log_message, previous_hash)
print(f"Safe Log: {safe_hash}")
🎯 Achievements
1.Accuracy in Detection: ≈94-96% on test data
2.Alerting Real-time alerts within <2 secs
3.Logs are completely tamper proof and are verifiable
Challenges | Faced
1.Finding a pure dataset of ransomware behavior was difficult.
2.Find a balance between false positives and alerts.
3.To make blockchain lightweight to not affect performance.
Conclusion
Through this project, I have realized that Cybersecurity is not only about coding but about thinking like a hacker as well. The combination of AI + Blockchain provided me with a different viewpoint.
If you are working on a similar Final Year Project or looking for the GitHub Code, then let’s connect!
*About the Author*
My name is Anoshay Ambar. I have graduated in Computer Science from COMSATS University Islamabad. I love cybersecurity, AI, and health tech.
Let’s get connected through: [LinkedIn](https://www.linkedin.com/in/anoshay-ambar-174011397) | Email: anoshayambar@gmail.com