Smart Decoy System using Machine Learning for Ransomware Defense

Real-Time Ransomware Detection, Intelligent Decoy Files, Machine Learning-Based Threat Analysis, and Automated Incident Response.

A Final Year B.Tech Computer Science & Engineering Project focused on proactive ransomware defence through deception technology, behavioral analytics, and machine learning.

Overview

Ransomware has evolved into one of the most destructive cyber threats, targeting personal systems, enterprises, educational institutions, healthcare organizations, and critical infrastructure. Traditional security solutions often rely on signature-based detection or identify attacks only after encryption has already begun, resulting in significant data loss.

The Smart Decoy System using Machine Learning for Ransomware Defense is designed to detect ransomware at an early stage by combining deception technology with behavioral machine learning.

Instead of waiting for legitimate user files to be encrypted, the system strategically deploys intelligent decoy (honeypot) files across monitored directories. These files act as early warning sensors that attract ransomware before valuable data is affected.

When suspicious interaction with decoy files is detected, the system performs real-time behavioral analysis, extracts relevant features, evaluates the activity using a trained Random Forest model, and automatically classifies the threat.

If ransomware behavior is confirmed, the platform immediately initiates automated mitigation actions including:

Process identification
Threat severity assessment
Evidence collection
Incident creation
Process quarantine
Response logging
Dashboard notification

The entire workflow is visualized through a modern Streamlit dashboard that provides real-time monitoring, incident management, analytics, and system health reporting.

This project demonstrates how deception-based cybersecurity techniques can be combined with machine learning to build an intelligent, proactive ransomware defence system capable of early detection and automated response.

Repository Highlights

✔ Intelligent Decoy File System ✔ Machine Learning-Based Detection ✔ Real-Time File Monitoring ✔ Automated Incident Response ✔ Interactive Streamlit Dashboard ✔ Modular Architecture

Key Features

Smart Decoy System

Intelligent decoy (honeypot) file deployment
Automatic decoy regeneration
Hidden monitoring directories
Multi-directory protection
Integrity verification using SHA-256 hashes

Real-Time File Monitoring

Continuous filesystem monitoring
File creation detection
File modification detection
File rename detection
File deletion detection
Burst activity detection
Extension change monitoring
Process attribution using process IDs

Activity Logging

Structured event logging
JSON incident storage
CSV dataset generation
Historical activity records
Timestamped event tracking

Machine Learning Pipeline

Behavioral feature engineering
Automated feature extraction
Random Forest classifier
Model persistence
Live prediction engine
Feature importance analysis
Confusion matrix evaluation

Real-Time Threat Detection

Live behavioral analysis
Probability-based classification
Dynamic severity scoring
Incident generation
Alert creation
Threat categorization

Automated Mitigation

Process quarantine
Automated response engine
Evidence preservation
Incident management
Response logging
Severity management
Recovery-ready workflow

Interactive Dashboard

Live monitoring dashboard
Incident timeline
Threat analytics
System health visualization
Mitigation history
Incident details
Responsive modular interface

Dataset Generation Framework

Normal activity simulator
Safe ransomware simulator
Automated dataset creation
Feature preprocessing
Training dataset generation
Balanced ML dataset preparation

Modular Architecture

Independent project modules
Clean project organization
Easy maintenance
Extensible design
Separation of responsibilities

Project Status

Current Version: v1.0.0

Status: Production-ready Academic Project

Development Status: Completed

Last Updated: July 2026

Why This Project?

Unlike traditional ransomware detection approaches that primarily depend on signatures or known malware indicators, this project emphasizes behavior-based detection.

The system is capable of identifying suspicious filesystem behavior regardless of ransomware family by monitoring interactions with strategically deployed decoy files and analyzing behavioral characteristics rather than relying solely on malware signatures.

This makes the approach more resilient against previously unseen or modified ransomware variants.

Project Architecture

The Smart Decoy System follows a modular, event-driven architecture where each component performs a dedicated responsibility. This design improves maintainability, scalability, and enables individual modules to evolve independently.

flowchart LR

A[User Activity / Ransomware]
    --> B[Smart Decoy System]

B --> C[Decoy File Monitoring]
C --> D[Activity Logger]

D --> E[Live Feature Extraction]
E --> F[Machine Learning Model]

F --> G{Threat Detected?}

G -->|No| H[Continue Monitoring]

G -->|Yes| I[Incident Manager]

I --> J[Severity Manager]
J --> K[Evidence Manager]
K --> L[Quarantine Manager]
L --> M[Mitigation Manager]

M --> N[Dashboard Manager]

N --> O[Streamlit Dashboard]

System Workflow

The project continuously monitors strategically placed decoy files across protected directories. Whenever a file event occurs, the system records the event and extracts behavioral characteristics over a time window.

These features are evaluated by the trained Machine Learning model. If the predicted probability exceeds the detection threshold, the incident is classified as ransomware and an automated response pipeline is initiated.

The complete workflow is illustrated below.

Filesystem Event
        │
        ▼
Smart Decoy Files
        │
        ▼
Real-Time File Monitoring
        │
        ▼
Event Logging
        │
        ▼
Live Feature Extraction
        │
        ▼
Random Forest Prediction
        │
        ▼
────────────────────────────
Prediction = Normal
────────────────────────────
Continue Monitoring

────────────────────────────
Prediction = Ransomware
────────────────────────────
        │
        ▼
Incident Creation
        │
        ▼
Severity Assessment
        │
        ▼
Evidence Collection
        │
        ▼
Process Quarantine
        │
        ▼
Mitigation Logging
        │
        ▼
Dashboard Notification

Project Structure

smart-decoy-ransomware-defense/
│
├── dashboard/
│   ├── app.py
│   ├── components/
│   ├── pages/
│   ├── utils/
│   ├── dashboard_data/
│   └── assets/
│
├── dataset/
│   ├── raw/
│   ├── processed/
│   ├── final_dataset.csv
│   ├── normal_features.csv
│   └── ransomware_features.csv
│
├── decoy_system/
│   ├── generate_decoys.py
│   ├── monitor_files.py
│   ├── decoy_manager.py
│   ├── log_activity.py
│   └── system_controller.py
│
├── manager/
│   ├── dashboard_manager.py
│   ├── evidence_manager.py
│   ├── incident_manager.py
│   ├── mitigation_manager.py
│   ├── process_response.py
│   ├── quarantine_manager.py
│   ├── response_logger.py
│   └── severity_manager.py
│
├── ml_engine/
│   ├── feature_extract/
│   ├── live_feature_extract/
│   └── ml_model/
│       ├── train_model.py
│       ├── ml_model.py
│       ├── ml_predictor.py
│       └── ransomware_model.pkl
│
├── simulator/
│   ├── normal_activity_simulator.py
│   └── ransomware_simulator.py
│
├── logs/
│
├── evidence/
│
├── quarantine/
│
├── docs/
│   ├── diagrams/
│   ├── images/
│   ├── reports/
│   └── screenshots/
│
├── requirements.txt
├── .gitignore
├── LICENSE
└── README.md

Technology Stack

Programming Language

Technology	Purpose
Python 3	Core application development

Machine Learning

Technology	Purpose
Scikit-learn	Model training and evaluation
Random Forest	Behavioral ransomware classification
Pandas	Dataset processing
NumPy	Numerical computation

File Monitoring

Technology	Purpose
Watchdog	Real-time filesystem monitoring
psutil	Process information and attribution
hashlib	SHA-256 integrity verification

Dashboard

Technology	Purpose
Streamlit	Interactive web dashboard
Plotly	Interactive charts
Altair	Statistical visualization

Data Storage

Format	Usage
CSV	Machine learning datasets
JSON	Incident records
Log Files	System logging

Development Environment

Component	Value
Operating System	Ubuntu Linux
IDE	Visual Studio Code
Version Control	Git
Repository Hosting	GitHub

Core Design Principles

The architecture of this project is guided by the following engineering principles.

Proactive Defense

The system attempts to identify ransomware before valuable user data is encrypted by monitoring intelligent decoy files rather than waiting for damage to occur.

Behavior-Based Detection

Detection decisions are based on observed filesystem behavior instead of static malware signatures, improving resilience against previously unseen ransomware variants.

Modular Architecture

Each subsystem is implemented as an independent module, allowing individual components to be maintained, replaced, or extended without impacting the rest of the application.

Automation First

Once malicious activity is detected, the response pipeline performs evidence collection, incident generation, quarantine, and logging automatically with minimal user intervention.

Explainable Machine Learning

The project uses engineered behavioral features with a Random Forest classifier, making it easier to inspect feature importance and understand detection decisions.

Demonstration Friendly

The repository includes:

Sample dashboard incidents for demonstration.
Pre-trained machine learning model.
Generated datasets for reproducibility.
Modular documentation.
Streamlit dashboard for live visualization.

Note

The sample incident records included in the dashboard are provided solely for demonstration purposes. During normal operation, these records are generated dynamically by the incident management pipeline.

Installation

This section describes how to set up and run the Smart Decoy System on a Linux environment.

The project has been developed and tested on Ubuntu Linux. Other Linux distributions may also work with minor modifications.

Prerequisites

Before installing the project, ensure that the following software is available on your system.

Requirement	Version
Python	3.10 or later
Git	Latest
pip	Latest
Ubuntu Linux	Recommended

Clone the Repository

git clone git@github.com:AtharDar/smart-decoy-ransomware-defense.git

cd smart-decoy-ransomware-defense

Create a Virtual Environment (Recommended)

Although not required, using a virtual environment is strongly recommended.

python3 -m venv venv

source venv/bin/activate

Install Dependencies

Install all required Python packages using:

pip install -r requirements.txt

Verify Installation

Run the following command to ensure all required packages are installed correctly.

python -c "import sklearn, watchdog, streamlit, psutil; print('Installation Successful')"

Repository Layout

After installation, the repository should resemble the following structure.

smart-decoy-ransomware-defense/
│
├── dashboard/
├── dataset/
├── decoy_system/
├── manager/
├── ml_engine/
├── simulator/
├── logs/
├── evidence/
├── quarantine/
├── docs/
├── requirements.txt
├── README.md
└── LICENSE

Quick Start

The project consists of multiple independent components that work together to provide real-time ransomware detection and automated mitigation.

The recommended execution order is shown below.

Generate Decoys
        │
        ▼
Start File Monitoring
        │
        ▼
Run Dashboard
        │
        ▼
(Optional)
Generate Dataset
        │
        ▼
Train ML Model
        │
        ▼
Real-Time Detection

Step 1 — Generate Smart Decoy Files

Generate decoy files across the configured directories.

python decoy_system/generate_decoys.py

This step creates strategically placed decoy files that act as early warning sensors for ransomware activity.

Step 2 — Start Real-Time Monitoring

Launch the real-time monitoring engine.

python decoy_system/monitor_files.py

This module continuously monitors the deployed decoy files for suspicious filesystem events such as:

File creation
File modification
File deletion
File renaming
Burst activity
Extension changes

Behavioral features are extracted and passed to the Machine Learning prediction engine in real time.

Step 3 — Launch the Dashboard

Start the Streamlit dashboard.

streamlit run dashboard/app.py

The dashboard provides:

Live incident monitoring
Threat analytics
Mitigation history
System health
Dashboard statistics
Interactive visualizations

Running the Complete System

In a typical deployment, the following components run simultaneously in separate terminals.

Terminal 1

python decoy_system/monitor_files.py

Terminal 2

streamlit run dashboard/app.py

Terminal 3 (Optional)

Normal activity simulation

python simulator/normal_activity_simulator.py

Terminal 4 (Optional)

Safe ransomware simulation

python simulator/ransomware_simulator.py

Important

The ransomware simulator included in this repository is intended only for research, educational, and testing purposes. It performs controlled file operations to simulate ransomware-like behavior without implementing malicious encryption.

Configuration

Most configurable parameters are defined within the project source code.

Examples include:

Monitored directories
Decoy file locations
Detection thresholds
Time window size
Machine learning parameters
Logging locations
Dashboard configuration

These settings can be adjusted to suit different deployment environments.

Machine Learning Model

A pre-trained Random Forest model is included in the repository.

ml_engine/
└── ml_model/
    └── ransomware_model.pkl

This allows the project to perform real-time predictions immediately after installation without requiring model retraining.

Included Datasets

The repository includes the datasets used during model development.

dataset/
├── raw/
├── processed/
├── final_dataset.csv
├── normal_features.csv
└── ransomware_features.csv

These datasets are provided to support reproducibility, experimentation, and further research.

Sample Dashboard Data

The dashboard includes a small set of sample incident records.

dashboard/dashboard_data/incidents.json

These records are intended solely for demonstration purposes.

During live execution, the incident management pipeline dynamically generates new incidents based on detected ransomware activity.

Logging

Runtime logs are written to the appropriate project directories.

logs/
evidence/
quarantine/

Each directory contains a placeholder .gitkeep file in the repository to preserve the directory structure. During execution, the application automatically generates runtime data within these locations.

Updating Dependencies

To update installed packages:

pip install --upgrade -r requirements.txt

Troubleshooting

Dashboard does not start

Ensure Streamlit is installed.

streamlit --version

Module import errors

Verify that all dependencies have been installed.

pip install -r requirements.txt

Machine Learning model not found

Ensure the following file exists.

ml_engine/ml_model/ransomware_model.pkl

No incidents appear on the dashboard

Verify that:

File monitoring is running.
Decoy files have been generated.
The monitored directories are configured correctly.
Sample incidents are present (for demonstration mode).

Permission errors

Some monitored directories may require elevated permissions depending on the deployment environment.

Run the application with appropriate permissions where necessary.

Dataset Generation Pipeline

Unlike many ransomware detection projects that rely entirely on publicly available datasets, this project generates its own behavioral dataset using controlled simulations.

The objective is to capture realistic filesystem behavior produced by both benign user activity and ransomware-like operations.

The generated events are transformed into machine learning features suitable for behavioral classification.

Dataset Generation Workflow

flowchart LR

A[Normal Activity Simulator]
B[Ransomware Simulator]

A --> C[Filesystem Events]
B --> C

C --> D[Event Logger]

D --> E[Feature Extraction]

E --> F[Feature Dataset]

F --> G[Dataset Preprocessing]

G --> H[Model Training]

Normal Activity Simulation

The normal activity simulator generates realistic user behavior including:

File creation
File editing
File copying
File renaming
File movement
Directory traversal

The generated activity represents ordinary filesystem usage and is labeled as Normal (0).

Ransomware Activity Simulation

The ransomware simulator safely reproduces behavioral characteristics commonly observed during ransomware attacks.

Examples include:

Rapid file modification
Bulk file access
Mass rename operations
Extension changes
High-frequency filesystem events
Burst activity

The simulator does not perform malicious encryption and is intended solely for research, testing, and educational purposes.

Generated samples are labeled as Ransomware (1).

Feature Engineering

Raw filesystem events are converted into numerical behavioral features.

Rather than analyzing file contents, the model learns patterns based on filesystem behavior over a configurable time window.

Examples of extracted features include:

Feature	Description
Files Modified	Number of modified files
Files Created	Number of created files
Files Renamed	Rename operations
Event Rate	Events per second
Modification Rate	Modification frequency
Rename Rate	Rename frequency
Rename Ratio	Rename/event ratio
Modification Ratio	Modification/event ratio
Unique Files	Distinct files accessed
Unique Extensions	Number of extensions observed
Directory Spread	Number of directories involved
Average Time Gap	Mean interval between events
Minimum Time Gap	Smallest interval
Maximum Time Gap	Largest interval

These engineered features form the input to the Random Forest classifier.

Machine Learning Pipeline

The machine learning component converts behavioral features into ransomware predictions.

The pipeline consists of:

flowchart LR

A[Behavioral Events]

A --> B[Feature Extraction]

B --> C[Feature Vector]

C --> D[Random Forest Model]

D --> E[Prediction]

E --> F[Threat Probability]

F --> G[Decision Engine]

Training Workflow

Filesystem Events
        │
        ▼
Feature Extraction
        │
        ▼
Feature Dataset
        │
        ▼
Dataset Cleaning
        │
        ▼
Training Dataset
        │
        ▼
Random Forest Training
        │
        ▼
Model Evaluation
        │
        ▼
Saved Model (.pkl)

Machine Learning Model

The project uses a Random Forest Classifier because it offers:

High classification accuracy
Robustness against noisy data
Resistance to overfitting
Fast prediction
Feature importance estimation
Minimal preprocessing requirements

The trained model is persisted as:

ml_engine/ml_model/ransomware_model.pkl

and is loaded automatically during live monitoring.

Model Evaluation

The model is evaluated using standard machine learning metrics including:

Accuracy
Precision
Recall
F1-Score
Confusion Matrix
Feature Importance

These metrics help assess the classifier's ability to distinguish between benign and ransomware behavior.

Real-Time Detection Pipeline

Once the model has been trained, it becomes part of the live detection engine.

Every filesystem event is processed through the following pipeline.

flowchart LR

A[Filesystem Event]

A --> B[Event Logger]

B --> C[Live Feature Extraction]

C --> D[Random Forest]

D --> E{Prediction}

E -->|Normal| F[Continue Monitoring]

E -->|Threat| G[Incident Manager]

Live Detection Process

The monitoring engine continuously watches the deployed decoy files.

Whenever suspicious activity occurs:

The filesystem event is recorded.
Behavioral features are updated.
The trained Random Forest model evaluates the feature vector.
A ransomware probability score is generated.
If the probability exceeds the configured threshold, an incident is created.
Automated mitigation is triggered.

This entire process typically completes within seconds of suspicious activity being observed.

Threat Classification

Each prediction is assigned a confidence score.

Example:

Probability = 0.94

Classification

Threat Level:
HIGH

Recommended Action:
Immediate Mitigation

This probability-based approach enables flexible threshold tuning for different deployment environments.

Automated Mitigation

Detection alone is insufficient for ransomware defence.

Once ransomware activity has been identified, the project automatically initiates an incident response workflow.

Mitigation Workflow

flowchart LR

A[Threat Detected]

A --> B[Incident Manager]

B --> C[Severity Manager]

C --> D[Evidence Manager]

D --> E[Quarantine Manager]

E --> F[Response Logger]

F --> G[Dashboard Manager]

G --> H[Dashboard Notification]

Incident Response

The response pipeline performs the following tasks automatically:

Creates a unique incident record.
Determines threat severity.
Preserves forensic evidence.
Records affected files.
Identifies the responsible process.
Initiates process quarantine (where applicable).
Logs all response actions.
Updates the Streamlit dashboard.

Evidence Collection

To assist forensic analysis, the system stores relevant evidence associated with detected incidents.

Examples include:

Event timestamps
File paths
Process information
Threat probability
Severity level
Triggering behavioral features

This information supports post-incident investigation and reporting.

Dashboard Integration

Every confirmed incident is immediately forwarded to the dashboard subsystem.

The dashboard displays:

New incidents
Threat severity
Detection timeline
Mitigation status
Historical events
System statistics

allowing administrators to monitor ransomware activity in real time.

End-to-End Processing Pipeline

The complete workflow of the Smart Decoy System is summarized below.

User Activity
        │
        ▼
Decoy Files
        │
        ▼
Filesystem Monitoring
        │
        ▼
Activity Logging
        │
        ▼
Live Feature Extraction
        │
        ▼
Random Forest Prediction
        │
        ▼
Threat Classification
        │
        ▼
Incident Creation
        │
        ▼
Evidence Collection
        │
        ▼
Automated Mitigation
        │
        ▼
Dashboard Notification

Design Highlights

The project combines multiple cybersecurity techniques into a unified defence platform.

Key capabilities include:

Intelligent deception using decoy files.
Continuous behavioral monitoring.
Machine learning–based ransomware detection.
Automated incident response.
Evidence preservation.
Interactive monitoring dashboard.
Modular architecture for future extensibility.

Together, these components demonstrate a proactive approach to ransomware defence that emphasizes early detection, rapid response, and operational visibility.

Dashboard

The Smart Decoy System includes a modern Streamlit-based dashboard that provides real-time visibility into ransomware detection, incident response, mitigation activities, and overall system health.

The dashboard is designed to demonstrate the complete detection lifecycle—from monitoring filesystem events to visualizing incidents and mitigation actions.

Dashboard Modules

Home

Provides a high-level overview of the system including:

Overall system status
Active monitoring state
Incident summary
Quick statistics
Recent activity

Incident Monitor

Displays detected incidents in real time with information such as:

Timestamp
Threat severity
Detection status
File path
Triggering process
Threat probability

Incident Details

Provides detailed forensic information for each incident, including:

Incident identifier
Affected files
Event timeline
Evidence collected
Severity level
Response actions

Mitigation Log

Tracks every automated response performed by the system.

Examples include:

Process response
Evidence collection
Quarantine actions
Response timestamps
Incident resolution status

Analytics

Visualizes historical activity using interactive charts.

Typical metrics include:

Incident trends
Severity distribution
Detection frequency
Event statistics
System activity

System Health

Displays operational information about the monitoring platform, including:

Monitoring engine status
Model availability
Active incidents
Log availability
Resource usage
Overall system health

Dashboard Screenshots

Replace the placeholders below with screenshots after publishing the project.

Home Dashboard

docs/screenshots/home_dashboard.png

Incident Monitor

docs/screenshots/incident_monitor.png

Incident Details

docs/screenshots/incident_details.png

Analytics Dashboard

docs/screenshots/analytics.png

System Health

docs/screenshots/system_health.png

Experimental Results

The project demonstrates an end-to-end ransomware defence workflow consisting of:

Intelligent decoy deployment
Real-time filesystem monitoring
Behavioral feature extraction
Machine learning–based threat classification
Automated incident creation
Evidence collection
Response logging
Interactive dashboard visualization

The system has been validated using controlled simulations of both normal user activity and ransomware-like behavior.

Note

The included ransomware simulator is designed for educational and research purposes only. It safely reproduces ransomware-like filesystem behavior without implementing malicious encryption.

Project Highlights

Intelligent decoy file deployment
Real-time filesystem monitoring
Behavioral machine learning detection
Random Forest classifier
Automated incident management
Evidence preservation
Modular architecture
Interactive Streamlit dashboard
Reproducible dataset generation
Open-source implementation

Future Enhancements

The modular architecture enables several potential extensions.

Detection

Deep Learning–based detection models
Online model retraining
Adaptive behavioral profiling
Ensemble classifiers
Explainable AI (XAI)

Platform Support

Windows support
Cross-platform monitoring
Containerized deployment
Kubernetes integration
Cloud-native architecture

Threat Intelligence

YARA rule integration
Sigma rule support
MITRE ATT&CK mapping
IOC enrichment
Threat intelligence feeds

Dashboard

Multi-user authentication
Role-based access control
Live notifications
Email alerts
Mobile-friendly interface
SIEM integration

Incident Response

Automatic backup restoration
Network isolation
Endpoint orchestration
Remote response capabilities
Integration with EDR platforms

Repository Roadmap

Contributing

Contributions are welcome.

If you would like to improve the project:

Fork the repository.
Create a feature branch.
Commit your changes.
Push the branch.
Open a Pull Request.

Please ensure that any contributions maintain the modular architecture and include appropriate documentation where applicable.

Security Notice

This repository is intended exclusively for:

Academic research
Cybersecurity education
Machine learning experimentation
Defensive security research
Demonstrations

The ransomware simulator included in this repository is a safe behavioral simulator and must not be modified or used for malicious purposes.

Citation

If this project contributes to your academic work or research, please consider citing it.

Athar Dar.

Smart Decoy System using Machine Learning for Ransomware Defense.

B.Tech Final Year Project,

SSM College of Engineering.

Academic Disclaimer

Academic Notice

This project was developed as a Bachelor of Technology (B.Tech) Final Year Project for educational and research purposes.

The included ransomware simulator is a safe behavioral simulator intended solely for defensive cybersecurity research.

License

This project is licensed under the MIT License.

See the LICENSE file for complete license information.

Author

Athar Dar

B.Tech Computer Science & Engineering

SSM College of Engineering

GitHub: https://github.com/AtharDar

Acknowledgements

This project was developed as part of the Bachelor of Technology (B.Tech) Final Year Project in Computer Science & Engineering.

The author gratefully acknowledges:

The faculty and project supervisors at SSM College of Engineering for their guidance and support.
The open-source Python community for providing the libraries that made this project possible.
The developers and maintainers of Scikit-learn, Streamlit, Watchdog, Pandas, NumPy, and Plotly for their excellent open-source tools.

Smart Decoy System using Machine Learning for Ransomware Defense

Early Detection • Intelligent Deception • Behavioral Analytics • Automated Response

Made with ❤️ using Python, Machine Learning, and Streamlit.

Name		Name	Last commit message	Last commit date
dashboard		dashboard
dataset		dataset
decoy_system		decoy_system
docs		docs
evidence		evidence
logs		logs
manager		manager
ml_engine		ml_engine
quarantine		quarantine
simulator		simulator
.gitattributes		.gitattributes
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CITATION.cff		CITATION.cff
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
requirements.txt		requirements.txt

Latest commit

History

Folders and files

Repository files navigation

Smart Decoy System using Machine Learning for Ransomware Defense

Overview

Repository Highlights

Key Features

Smart Decoy System

Real-Time File Monitoring

Activity Logging

Machine Learning Pipeline

Real-Time Threat Detection

Automated Mitigation

Interactive Dashboard

Dataset Generation Framework

Modular Architecture

Project Status

Project Status

Why This Project?

Table of Contents

Project Architecture

System Workflow

Project Structure

Technology Stack

Programming Language

Machine Learning

File Monitoring

Dashboard

Data Storage

Development Environment

Core Design Principles

Proactive Defense

Behavior-Based Detection

Modular Architecture

Automation First

Explainable Machine Learning

Demonstration Friendly

Installation

Prerequisites

Clone the Repository

Create a Virtual Environment (Recommended)

Install Dependencies

Verify Installation

Repository Layout

Quick Start

Step 1 — Generate Smart Decoy Files

Step 2 — Start Real-Time Monitoring

Step 3 — Launch the Dashboard

Running the Complete System

Terminal 1

Terminal 2

Terminal 3 (Optional)

Terminal 4 (Optional)

Configuration

Machine Learning Model

Included Datasets

Sample Dashboard Data

Logging

Updating Dependencies

Troubleshooting

Dashboard does not start

Module import errors

Machine Learning model not found

No incidents appear on the dashboard

Permission errors

Dataset Generation Pipeline

Dataset Generation Workflow

Normal Activity Simulation

Ransomware Activity Simulation

Feature Engineering

Machine Learning Pipeline

Training Workflow

Machine Learning Model

Model Evaluation

Real-Time Detection Pipeline

Live Detection Process

Threat Classification

Automated Mitigation

Mitigation Workflow