Academic
Mass-encryption detector | Signature-free containment
It contains mass encryption without having seen the binary and with nobody in the loop. Three system signals form a score, and only the score decides.
- Security
- Infrastructure
- Organisation
- Universidad Técnica Nacionalopens in a new tab
- Role
- Detection and containment
- Period
- 2026-07 — 2026-08
Stack
- Python
- Linux
- Terraform
- AWS
Context
An individual final project for IT Security I, the same course as the spyware analysis. The brief asked for an autonomous detection and containment tool, plus a test bench to exercise it on.
The exercise runs on an ephemeral AWS instance provisioned for it. Nothing executed there touches a system in use.
Problem
The brief asked for detection and containment without human intervention, and without knowing the binary in advance.
A signature list only recognises what has been seen before, so the question becomes a different one: what does the operating system observe when something encrypts files in bulk, and how much of that can be measured without identifying the program.
Technical decisions
Three independent signals, none conclusive on its own.
Filesystem events say there is activity. The entropy of what is written says the content has stopped resembling a document. Sampling write_bytes per process every 500 ms says who is writing.
A separate component combines the three into a score, and only that score decides containment.
Architecture
A filesystem watcher deposits events into a locked buffer. A sampling thread keeps the most recent snapshot of writes per process. The main thread reads the score once a second and decides whether to act.
A watcher records creations, writes and renames into a locked buffer. It says there is activity, not who is producing it.
The entropy of what is written is measured. Content close to random indicates the file has stopped resembling a document, without opening or identifying it.
Sampling write_bytes per process every 500 ms attributes the volume written to a specific process. It is the only one of the three signals that identifies the responsible party.
No signal contains on its own. The component that combines them is the only one able to order containment, so thresholds are tuned without touching the sensors.
Containment kills the process tree and moves the binary into a quarantine directory with no execute permission.
The test bench’s infrastructure is described in Terraform, so the lab is created and destroyed with one command and every run starts from the same machine. Terraform state and the variables file are kept out of version control, because a state file stores sensitive values in the clear.
Result
The detector contains bulk encryption without having seen the binary before. It reacts to what the process does, which was the point of the exercise.
What I learned
The threshold was the hard part. A legitimate backup produces a pattern very close to mass encryption: many files written quickly, with high-entropy content.
With the three signals available I found no value that separates the two cases. The delivered version prefers not to miss a real case and accepts false positives, and the threshold is documented with that justification.