1. Introduction

The Ransomware Behaviour Simulation & Prevention Tool is a Python-based cybersecurity project to study, simulate, and mitigate ransomware in a safe sandbox. It mimics encryption behavior, observes system impacts, and deploys real-time prevention like process blocking and automated recovery from secure backups. Ideal for hands-on learning and practical defense testing.

2. Existing System vs Proposed System

3. Working

1. Simulation Module: Creates a sandbox and encrypts sample files with AES/XOR.
2. Monitoring Module: Watchdog tracks file creates/renames/extension bursts.
3. Behavioral Detection: Flags mass encryption rates, suspicious write patterns.
4. Alert & Prevention: Terminates process, quarantines directory, isolates keys.
5. Recovery: Restores originals from backup store.
6. Report: Generates summary with indicators and actions taken.

4. Technology Stack

• Language: Python
• Libraries: os, shutil, hashlib, psutil, watchdog, PyCryptodome, pandas, scikit-learn
• Algorithms: AES for simulation; Random Forest/SVM for detection
• Database: SQLite3/CSV for logs & threat history
• Interface: Tkinter or Flask dashboard
• Platform: Windows/Linux sandbox

5. Modules

6. Advantages

• Safe hands-on ransomware lab with zero system risk.
• Behavior-first approach catches novel variants.
• Real-time alerts and automatic prevention.
• Deep learning for cybersecurity students & teams.
• Foundation for next-gen endpoint protection.

7. Applications

• Academic labs & research on ransomware behavior.
• Security training for IT professionals.
• Sandbox testing for AV/EDR models.
• Enterprise readiness drills & tabletop exercises.
• Awareness demos for non-technical audiences.

Python Integration Sketch (Watchdog + PyCryptodome + ML)

import os, time, shutil, hashlib, psutil, sqlite3
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
import joblib  # for RandomForest/SVM model (optional)

SANDBOX = "sandbox/"
BACKUP  = "backup/"
DB      = "events.db"
THRESH_FILES_PER_MIN = 40  # example threshold for mass-encrypt behavior

def encrypt_file(path, key):
    # AES-CTR demo encryption (sandbox only)
    with open(path, "rb") as f: data = f.read()
    cipher = AES.new(key, AES.MODE_CTR)
    ct = cipher.encrypt(data)
    with open(path + ".enc", "wb") as f: f.write(cipher.nonce + ct)
    os.remove(path)

def simulate_encryption():
    key = get_random_bytes(16)
    for root,_,files in os.walk(SANDBOX):
        for name in files:
            if not name.endswith(".enc"):
                encrypt_file(os.path.join(root,name), key)
                time.sleep(0.05)  # pacing for demo

class RansomEventHandler(FileSystemEventHandler):
    def __init__(self):
        self.events = []
        self.last_min = int(time.time() // 60)
    def on_modified(self, event):
        self.track(event)
    def on_created(self, event):
        self.track(event)
    def track(self, event):
        now_min = int(time.time() // 60)
        if now_min != self.last_min:
            self.evaluate_rate()
            self.events.clear()
            self.last_min = now_min
        self.events.append(event.src_path)
    def evaluate_rate(self):
        rate = len(self.events)
        if rate > THRESH_FILES_PER_MIN:
            alert_and_prevent("Mass encryption rate detected")

def alert_and_prevent(reason):
    # Kill suspected processes (demo: own PID)
    for p in psutil.process_iter(["pid","name","cmdline"]):
        try:
            if "python" in (p.info["name"] or "").lower():
                p.terminate()
        except Exception:
            pass
    # Quarantine sandbox
    shutil.make_archive("quarantine", "zip", SANDBOX)
    # Restore from BACKUP
    restore_from_backup()
    log_incident(reason)

def restore_from_backup():
    if os.path.exists(BACKUP):
        for root,_,files in os.walk(BACKUP):
            for name in files:
                src = os.path.join(root,name)
                dst = src.replace(BACKUP, SANDBOX)
                os.makedirs(os.path.dirname(dst), exist_ok=True)
                shutil.copy2(src, dst)

def log_incident(msg):
    conn = sqlite3.connect(DB)
    cur = conn.cursor()
    cur.execute("CREATE TABLE IF NOT EXISTS incidents(ts INTEGER, msg TEXT)")
    cur.execute("INSERT INTO incidents VALUES(?,?)", (int(time.time()), msg))
    conn.commit(); conn.close()

if __name__ == "__main__":
    # Setup backup first, then run Observer + optional simulate_encryption()
    handler = RansomEventHandler()
    obs = Observer(); obs.schedule(handler, SANDBOX, recursive=True); obs.start()
    try:
        simulate_encryption()  # for demo only
        while True: time.sleep(1)
    except KeyboardInterrupt:
        obs.stop()
    obs.join()
              

What You Get