|
1 | | -# SO_2_1_Dobra_Mihai |
| 1 | +# Folder Integrity and Malicious File Scanner |
| 2 | + |
| 3 | + |
| 4 | +[](https://en.wikipedia.org/wiki/C_(programming_language)) |
| 5 | +[](https://opensource.org/licenses/MIT) |
| 6 | +[](https://www.upt.ro/) |
| 7 | +[](https://github.com/mijay6/Operating-System-File-Monitoring-Tool) |
2 | 8 |
|
3 | | -## Name |
4 | | -Proiect S0. |
5 | 9 |
|
6 | 10 | ## Description |
7 | | -Acest program va analiza o serie de foldere si in functie de cum se apeleaza programul, |
8 | | -va realiza diferite functionalitati in aceste foldere. |
| 11 | +This utility scans one or more directories (and their subdirectories), computes and stores SHA-256 checksums and metadata for every file, then compares snapshots across runs to detect: |
| 12 | + |
| 13 | +- **Additions**: new files or folders |
| 14 | +- **Deletions**: removed files or folders |
| 15 | +- **Modifications**: changes in content (checksum), name, type or permissions |
| 16 | + |
| 17 | +Additionally, an optional mode will analyze each file for malicious characteristics (based on size, content, keywords, or non-ASCII characters) and move any flagged files to an isolation folder. |
| 18 | + |
| 19 | +## Features |
9 | 20 |
|
10 | | -## Installation |
11 | | -Va fi compilat asa: gcc -Wall -o prog prog.c -lssl -lcrypto |
| 21 | +- Recursively traverse directories and record metadata in a snapshot file (`<dirname>_snapshot.dat`). |
| 22 | +- Compare current and previous snapshots to list added, removed, or modified entries. |
| 23 | +- Compute SHA-256 checksum using OpenSSL. |
| 24 | +- `-o` option: specify an output directory for generated snapshots. |
| 25 | +- `-s` option: specify an isolation directory for malicious files. |
| 26 | +- Concurrent processing: each directory is scanned in parallel to improve performance. |
| 27 | +- Malicious file detection via a helper Bash script (`verify_for_malicious.sh`). |
| 28 | + |
| 29 | +## Prerequisites & Build |
| 30 | + |
| 31 | +- **GCC** (with C99 support) |
| 32 | +- **OpenSSL** development libraries (for SHA-256) |
| 33 | + |
| 34 | +Compile with: |
| 35 | + |
| 36 | +```bash |
| 37 | +gcc -Wall -o prog prog.c -lssl -lcrypto |
| 38 | +``` |
12 | 39 |
|
13 | 40 | ## Usage |
14 | 41 |
|
15 | | -./prog folder1 folder2 folder3...etc (maxim 10 directoare) |
| 42 | +```bash |
| 43 | +# Basic snapshot and comparison |
| 44 | +./prog folder1 folder2 ... |
| 45 | + |
| 46 | +# Save snapshots to a dedicated output directory |
| 47 | +./prog -o snapshots_out folder1 folder2 ... |
| 48 | + |
| 49 | +# Additionally isolate malicious files to a quarantine directory |
| 50 | +./prog -o snapshots_out -s quarantine_dir folder1 folder2 ... |
| 51 | +``` |
| 52 | + |
| 53 | +## Behavior |
| 54 | + |
| 55 | +First run: generates `<dirname>_snapshot.dat` and reports |
| 56 | +> "First run: no previous snapshot found." |
| 57 | +
|
| 58 | +Subsequent runs: compares to previous snapshot and prints: |
| 59 | + |
| 60 | +- **Added**: new files or folders |
| 61 | +- **Removed**: deleted files or folders |
| 62 | +- **Modified**: name change, content change, permission change, size change, or type change |
| 63 | + |
| 64 | +**With `-s`**: files deemed malicious are moved to the specified quarantine directory. |
| 65 | + |
| 66 | +## Malicious File Detection |
| 67 | + |
| 68 | +The script `verify_for_malicious.sh` applies the following heuristics: |
| 69 | + |
| 70 | +1. Flags files exceeding **100 lines**, **5 000 words**, or **10 000 characters** as dangerous. |
| 71 | +2. Flags files with fewer than **3 lines** but more than **1 000 words** or **2 000 characters** as suspicious, then: |
| 72 | + - Searches for keywords: `corrupted`, `dangerous`, `risk`, `attack`, `malware`, `malicious`. |
| 73 | + - Detects non-ASCII characters. |
| 74 | +3. Any flagged file has its permissions revoked and is either printed (`SAFE` or file path) or moved to quarantine. |
16 | 75 |
|
17 | | -Se da ca parametru unul sau mai multe foldere si programul va calcula suma de control SHA-256 |
18 | | -a tuturor fisierelor din folder si subfoldere si va pastra metadatele fiecarei fisiere din folder |
19 | | -intrun fisier snapshot. Va compara snapshotul anterior cu cel actual si va printa modificarile. |
20 | | ----------------------------------------------------------------------- |
21 | | -./prog -o outputdir folder1 folder2 folder3...etc (maxim 10 directoare) |
| 76 | +## Test Folders |
22 | 77 |
|
23 | | -Functionalitatea este extinsa cu un parametru -o urmat de un folder unde |
24 | | -se vor pune fisierele snapshot ale folderelor date ca parametru |
25 | | ----------------------------------------------------------------------- |
26 | | -./prog -o outputdir -s izolated_space_dir folder1 folder2 folder3...etc (maxim 10 directoare) |
| 78 | +This repository includes three sample test folders: |
27 | 79 |
|
28 | | -Functionalitatea este extinsa cu un parametru -s urmat de un folder unde se vor muta fisierele malitioase |
29 | | ----------------------------------------------------------------------- |
| 80 | +- `test_folder1/` |
| 81 | +- `test_folder2/` |
| 82 | +- `test_folder3/` |
30 | 83 |
|
31 | | -## Authors and acknowledgment |
32 | | -Dobra Mihai |
| 84 | +Each contains various files and nested directories (including deliberately malicious files) to validate snapshot integrity and malicious detection. |
33 | 85 |
|
34 | | -## License |
35 | | -Open Source |
| 86 | +## Author |
| 87 | +Politehnica University of Timișoara |
| 88 | +Faculty of Automation and Computer Science |
| 89 | +Operating systems |
| 90 | +Academic Year 2023-2024 |
36 | 91 |
|
37 | | -## Project status |
38 | | -Finish |
| 92 | +## Contributing |
| 93 | +Please read [CONTRIBUTING.md](CONTRIBUTING.md) for details on our code of conduct and the process for submitting pull requests. |
0 commit comments