Keylogger Detection Tool for Windows – Real-Time Privacy Protection

1. Introduction

The Keylogger Detection Tool for Windows is a Python-based cybersecurity project designed to identify and neutralize keylogging software running on Windows systems. Keyloggers secretly record keystrokes to steal sensitive information such as passwords, card numbers, and personal data. This tool scans processes, registry entries, and network activity to detect suspicious keylogging behavior using machine learning and rule-based heuristics. It provides real-time alerts, system reports, and mitigation options—bolstering privacy and security.

2. Existing System vs Proposed System

3. Working

1. System Scan Initialization: Launch tool on Windows.
2. Process Monitoring: Flag apps interacting with keyboard APIs/hooks.
3. Registry Inspection: Audit startup (Run/RunOnce/Services/Tasks).
4. Network Monitoring: Track suspicious outbound connections.
5. Detection & Reporting: Show evidence and confidence scores.
6. Optional Mitigation: Terminate/quarantine recommendations.

4. Technology Stack

• Language: Python
• Libraries: psutil, winreg, os, socket, pandas, tkinter
• Algorithm: Rule-based + anomaly thresholds (stats)
• Platform: Windows 7/8/10/11
• Interface: CLI or Tkinter GUI
• Database: CSV/SQLite for logs & reports

5. Modules

6. Advantages

• Extra protection beyond standard antivirus.
• Detects known & unknown keyloggers via heuristics.
• Lightweight, low resource usage.
• Detailed logs and evidence for investigation.
• Customizable for enterprise policies.

7. Applications

• Personal PC protection against credential theft.
• Enterprise monitoring & SOC enrichment.
• Educational projects in ethical hacking/malware analysis.
• Cyber forensics for malicious activity identification.

Python Integration Sketch (psutil + winreg + sockets)

import psutil, socket, os, time, pandas as pd
from datetime import datetime
try:
    import winreg  # Windows-only
except ImportError:
    winreg = None

SUSPICIOUS_APIS = {"SetWindowsHookEx", "GetAsyncKeyState", "GetForegroundWindow"}
RISK = {}

def score(pid, reason, w=1.0):
    RISK[pid] = RISK.get(pid, 0) + w

def scan_processes():
    for p in psutil.process_iter(['pid','name','exe','username','connections']):
        try:
            # 1) Check suspicious names/locations (heuristic)
            if p.info['name'] and any(x in p.info['name'].lower() for x in ['keylog','logger','hook']):
                score(p.pid, 'name_match', 2.0)

            # 2) DLL/module hints (pseudo; use pefile/ctypes in real impl)
            # if uses_keyboard_hook(p): score(p.pid, 'kb_hook', 3.0)

            # 3) Outbound connections to odd ports/foreign IPs
            for c in p.connections(kind='inet'):
                if c.raddr and c.status == psutil.CONN_ESTABLISHED:
                    ip, port = c.raddr.ip, c.raddr.port
                    if port in (21,23,25,8080) or is_suspicious_ip(ip):
                        score(p.pid, f'net_exfil:{ip}:{port}', 1.5)
        except Exception:
            continue

def scan_registry_autoruns():
    if not winreg: return
    roots = [
        (winreg.HKEY_CURRENT_USER, r"Software\Microsoft\Windows\CurrentVersion\Run"),
        (winreg.HKEY_LOCAL_MACHINE, r"Software\Microsoft\Windows\CurrentVersion\Run"),
    ]
    for root, path in roots:
        try:
            with winreg.OpenKey(root, path) as k:
                i = 0
                while True:
                    try:
                        name, val, _ = winreg.EnumValue(k, i)
                        if any(x in str(val).lower() for x in ['keylog','hidden','appdata\\roaming']):
                            # map value to process later; increase baseline risk
                            # (In practice correlate exe path -> pid)
                            pass
                        i += 1
                    except OSError:
                        break
        except OSError:
            pass

def is_suspicious_ip(ip):
    try:
        socket.inet_aton(ip)
        # simple placeholder heuristic (replace with reputation/geo lookup)
        return ip.startswith(("5.","37.","45.","89.","188."))
    except OSError:
        return False

def classify():
    # convert RISK to decisions with thresholds
    df = pd.DataFrame([{'pid':pid,'risk':r} for pid,r in RISK.items()])
    df['label'] = df['risk'].apply(lambda r: 'Suspicious' if r>=3.0 else ('Watch' if r>=1.5 else 'Clean'))
    return df.sort_values('risk', ascending=False)

if __name__ == "__main__":
    while True:
        RISK.clear()
        scan_processes()
        scan_registry_autoruns()
        report = classify()
        # show alerts for 'Suspicious', write CSV/SQLite, and allow terminate()
        time.sleep(30)
              

What You Get