Argus: Advanced Fileless Malware Detection System

Argus is a state-of-the-art security system designed to detect, analyze, and explain fileless malware attacks (e.g., PowerShell injection, LOLBins) using a hybrid approach of Real-time Monitoring and AI-powered Analysis.

🌟 Key Features

1. Real-time Monitoring (Argus Eye)

• Event-driven Detection: Utilizes Sysmon to capture high-fidelity events (Process Creation, Remote Threads, DNS).
• Polling Architecture: Robust polling mechanism (sysmon_monitor.py) ensures stability and avoids event loss.
• Deep Integration: Automatically triggers memory dumps and analysis upon detection.

2. AI & Deep Learning Core

• Stage Classification: Uses a fine-tuned BERT model to classify attack stages (Initial Access, Execution, Persistence, etc.) with 91.24% accuracy.
• Explainable AI: Harnesses Llama-2 (LoRA fine-tuned) to generate human-readable explanations for suspicious commands.

3. Automated Forensics (Level 2 Automation)

• Memory Dumping: Automatically captures process memory using ProcDump when a suspicious process is detected.
• WinDBG Analysis: Parses .dmp files to extract loaded modules, IAT, and strings for deeper context.

4. Professional Dashboard

• Live Monitor: Real-time feed of security alerts.
• Deep Analysis UI: Interactive interface to view AI explanations and forensic reports.
• System Health: Health checks for all system components.

---

🏗️ Architecture

graph TD
    A[Sysmon Event Log] -->|Polls| B[Monitor Agent]
    B -->|Verify Process| C{Is Alive?}
    C -->|Yes| D[ProcDump]
    D -->|Dump File| E[WinDBG Tool]
    E -->|Analysis Report| F[API Backend]
    C -->|No| F
    
    F -->|Store| G[(SQLite DB)]
    H[Streamlit Dashboard] <-->|Fetch/Poll| F
    
    F <-->|Inference| I[AI Pipeline]
    I -->|Classify| J[BERT]
    I -->|Explain| K[Llama]

Loading

---

🚀 Installation

Prerequisites

• Python 3.10+
• Administrator Privileges (Required for Sysmon/ProcDump)
• External Tools:
  • Sysmon (Installed & Configured)
  • ProcDump (In tool/ or System PATH)
  • Debugging Tools for Windows (cdb.exe)

Setup Environment

Note: Argus is built entirely on Python. You do NOT need Node.js or NPM installed.

1. Clone & Virtual Env

   git clone https://github.com/your-repo/argus.git
   cd argus
   python -m venv venv
   .\venv\Scripts\activate  # Windows
   # source venv/bin/activate  # Linux/Mac

2. Install Dependencies

   pip install -r requirements.txt

   This installs all core libraries: FastAPI, Streamlit, PyTorch, Transformers, etc.

3. Verify Installation

   streamlit --version
   # Should show Streamlit, e.g., Streamlit, version 1.31.0

---

💻 Usage

To run the full system, you need to start 3 separate terminals:

Terminal 1: Backend API

Starts the brain of the system.

uvicorn api.main:app --reload --port 8000

Terminal 2: Dashboard

Starts the user interface.

streamlit run app.py

Access at: http://localhost:8501

Terminal 3: Monitoring Agent (Admin)

Starts the eyes of the system. Must run as Administrator.

python sysmon_monitor.py

---

📂 Project Structure

fileless/
├── api/                 # FastAPI Backend & Database Logic
│   ├── main.py
│   ├── models.py
│   └── database.py
├── evaluate/            # Model Evaluation Scripts
├── models/              # Trained AI Models (BERT/Llama)
├── tool/                # External Tools (Optional location)
├── app.py               # Streamlit Dashboard
├── sysmon_monitor.py    # Main Monitoring Agent
├── memory_dumper.py     # ProcDump Wrapper
├── windbg_tool.py       # WinDBG Wrapper
├── inference_pipeline.py# AI Inference Logic
└── requirements.txt     # Dependencies

Kaggle

Llama:

• Code
• Dataset
• Evaluation

BERT:

• Code
• Dataset

---

🛡️ Supported Detections (Examples)

• PowerShell Abuse: powershell -enc ..., powershell -nop -w hidden
• LOLBins: mshta.exe, rundll32.exe, regsvr32.exe
• Injection: Code injection into explorer.exe or svchost.exe
• C2 Beaconing: Suspicious DNS queries to known bad TLDs.

---

📝 License

Argus is open-source software licensed under the MIT License.