buter-chkalova/rvbbitsafeA next-generation multi-echelon anti-ransomware fortress for Windows, combining hypervisor, eBPF, AI deception, and hardware-enforced security.
RvbbitSafe is a research prototype demonstrating a paradigm shift in ransomware defense. It's an active, multi-layered fortress that combines hardware virtualization, AI-driven deception, low-level data recovery, decentralized threat intelligence, and a Neuro-Symbolic AI engine to make successful ransomware attacks economically and technically unviable.
This project is the result of integrating cutting-edge academic research into a single, practical framework, designed to be a hacker's worst nightmare and a blueprint for the next generation of cybersecurity.
| Fortress | Core Innovation | Technical Implementation |
|---|---|---|
| 1. Pre-Execution Fortress | Hypervisor-Based Process Isolation | A lightweight hypervisor (src/hypervisor/) intercepts process creation and driver loading, verifying signatures and blocking BYOVD attacks before the OS kernel executes them. |
| 2. Runtime Deception Fortress | LLM-Powered Dynamic Deception Mesh | A local DeBERTa model (src/user/llm_deception_engine/) generates convincing honeyfiles. An eBPF driver (src/kernel/rvbbit_ebpf_driver.c) redirects ransomware I/O to these traps. |
| 3. Post-Breach Resilience Fortress | SSD Semantic Recovery (SrFTL) | A kernel driver (src/kernel/rvbbit_ssd_recovery.c) bypasses the file system to directly query the SSD's FTL, instantly recovering "deleted" files from unerased physical blocks. |
| 4. Threat Intelligence Mesh | Blockchain-Federated Learning (BFL) | RvbbitSafe nodes participate in a decentralized network (src/user/blockchain_comm/) to collaboratively train a threat detection model without sharing private data. |
| 5. Anti-Tampering Fortress | Hardware-Enforced Security (VBS Enclaves) | Core logic runs inside a Windows VBS Enclave (src/user/service/), protected by Intel CET/AMD Shadow Stack. It is immune to attacks from a compromised OS kernel. |
| 6. Proactive Neuro-Symbolic Analytics | Explainable & Predictive AI Defense | This fortress combines a neural anomaly detector with a symbolic rules engine (src/user/neuro_symbolic_engine/). It can detect zero-day threats and explain its reasoning, a critical feature for security analysts. |
Prerequisites:
Build:
Run scripts/build_all.bat from a Developer Command Prompt for VS 2022.
Deploy:
Run scripts/deploy_full.ps1 as Administrator.
⚠️ WARNING: This is an alpha research prototype. It includes kernel drivers and a hypervisor. Use only on a dedicated virtual machine or test hardware.
We welcome community testing! See TESTING.md for instructions on how to safely evaluate RvbbitSafe.
For a complete architectural deep dive, see the Technical Whitepaper.
This project is licensed under the MIT License - see the LICENSE file for details.
Disclaimer: This project is for educational and research purposes only.
