SentinalCore

SentinalCore is a comprehensive malware detection and isolation framework designed for Linux systems. It combines multiple detection methods with advanced isolation techniques to identify and contain potential threats.

Features

Malware Detection

SentinalCore uses a multi-layered approach to detect potential threats:

• ClamAV Integration - Signature-based detection using the established ClamAV antivirus engine
• File Entropy Analysis - Statistical analysis to identify suspicious encryption or packing
• VirusTotal API - Cloud-based malware intelligence platform integration
• LLM-Powered Log Analysis - Advanced system log analysis using large language models
• File System Scanning - Comprehensive scanning of the user's file system with configurable parameters

Threat Isolation

When threats are detected, SentinalCore can isolate them using:

• Passive Isolation - Linux namespace separation (PID, mount, network, etc.)
• Process Containment - Restricting process capabilities and access
• Network Restriction - Preventing malicious processes from communicating with the network

Technical Overview

Core Components

Detection Engine

• ClamAV Scanner: Integrates with ClamAV for signature-based detection
• Entropy Analyzer: Performs statistical analysis to detect suspicious files
• VirusTotal Client: Interfaces with VirusTotal API for cloud-based detection
• Log Analyzer: Uses LLM to identify suspicious patterns in system logs

Isolation Framework

• Namespace-based Isolation: Uses Linux kernel namespaces to isolate processes
• Resource Limiting: Controls CPU, memory, and network usage for suspicious processes
• Monitoring Interface: Real-time monitoring of isolated processes

Requirements

- Python 3.10+
- ClamAV (with freshclam)
- BCC (eBPF Compiler Collection)
- Linux kernel 4.15+ (for namespace functionality)

Installation

1. Install dependencies

# Install system dependencies
sudo apt update
sudo apt install clamav clamav-daemon bpfcc-tools python3-dev python3-pip

# Start ClamAV services
sudo systemctl enable clamav-freshclam
sudo systemctl start clamav-freshclam
sudo systemctl enable clamav-daemon
sudo systemctl start clamav-daemon

2. Install SentinalCore

# Clone the repository
git clone https://github.com/username/sentinalcore.git
cd sentinalcore

# Install Python dependencies
pip install -e .

3. Configuration

# Set up API keys (optional but recommended)
export VIRUSTOTAL_API_KEY="your_virustotal_api_key"
export GEMINI_API_KEY="your_gemini_api_key"

Usage

Basic Scanning

# Scan a single file
python detection/main.py --scan-file /path/to/file

# Scan a directory
python detection/main.py --scan-dir /path/to/directory

# Scan home directory
# Scan a directory
python detection/main.py --scan-dir /path/to/directory

# Scan home directory
python detection/main.py --scan-home

# Full system scan with VirusTotal integration
python detection/main.py --full-scan --check-virustotal

Log Analysis

# Analyze system logs for the past hour
python detection/main.py --analyze-logs --log-time 60

# Analyze logs with custom output file
python detection/main.py --analyze-logs --output-file results.json

Advanced Usage

# Perform full system scan with all detection methods
python detection/main.py --full-scan --check-virustotal --analyze-logs --log-time 120 --verbose

🧪 Testing

The project includes a comprehensive test suite:

# Run all tests
pytest

# Run specific test module
pytest testing/test_clamav.py

Test data and logs are stored in the testing/logs/ directory.

💻 Development

Project Structure

sentinalcore/
├── detection/          # Detection modules
│   ├── clamav_scan.py  # ClamAV integration
│   ├── entropy.py      # File entropy analysis
│   ├── LLMlogs.py      # Log analysis with LLM
│   ├── main.py         # Main detection interface
│   └── virustotalUpload.py  # VirusTotal API client
├── gui/                # GUI interface (under development)
├── isolation/          # Process isolation modules
│   └── passive_isolation.py  # Namespace-based isolation
└── testing/            # Test modules and fixtures
    ├── test_*.py       # Test files
    └── logs/           # Sample logs for testing

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📜 License

This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.

⚠️ Disclaimer

SentinalCore is designed for security research and legitimate system administration purposes only. Always obtain proper authorization before scanning systems or networks you don't own. The developers are not responsible for any misuse of this software.

📧 Contact

For questions, feedback, or contributions, please open an issue on the project repository.

---

SentinalCore: Detect, Isolate, Protect.