nirvanaon/antive-behaviorwatchEmbedded GRU neural network for real-time human behavior verification via mouse movement analysis, detecting automated analysis systems, sandboxes, and emulation environments on Windows.
Embedded AI-powered human behavior verification for cybersecurity research.
AntiVE-BehaviorWatch is a Windows-based cybersecurity research project that explores a new approach to execution control using embedded artificial intelligence.
Instead of relying on traditional anti-analysis techniques such as virtual machine detection, sandbox detection, debugger checks, or hardware fingerprinting, the project uses an embedded GRU (Gated Recurrent Unit) neural network to determine whether a real human is interacting with the system.
The model analyzes real-time mouse behavior—including cursor movement, velocity, acceleration, jerk, angular velocity, idle patterns, and motion characteristics—to make an intelligent runtime decision before allowing the protected execution path to continue.
Mouse Movement
│
▼
Feature Extraction
│
▼
Embedded GRU Neural Network
│
▼
Behavior Classification
│
┌─────┴────────┐
│ │
▼ ▼
Human Idle / Artificial
Verified Behavior
│ │
▼ ▼
Continue Abort
Execution
The embedded model analyzes multiple behavioral features:
These features are collected continuously over multiple observation phases before inference.
This project is intended strictly for cybersecurity research, machine learning experimentation, education, and authorized security testing.
It demonstrates how embedded AI can be used for behavioral verification and runtime decision-making. It is not intended for unauthorized or malicious use.
Nirvana (0xNirSec)
"Trust behavior, not the environment."