PROJECT DOCUMENTATION: BHPAI

System Version: V1.6 Enterprise Edition (Comprehensive System Feature Update)
Author: Rin449 Core Languages & Technologies: C++17 (MinGW-w64 / MSYS2), Python 3.9+, PyQt6, MinHook, Capstone Engine, Intel PT (Processor Trace), PyTorch, LightGBM, OpenSSL 3.x, zlib, Argon2id, Cryptography, Ed25519
Master Reference Documentation: Multi-Format architecture details, recursive analysis algorithms, PE & PDF static analysis, Sandbox Stealth Ring-3 dynamic monitoring, Ransomware key structure extraction, False Positive Resistant AI model, WinRE offline rescue system, and Zero-Knowledge data security.

Language / Ngôn ngữ: 🇻🇳 Tiếng Việt | 🇬🇧 English

---

OVERVIEW TABLE OF CONTENTS

1. PROJECT OVERVIEW & MULTI-FORMAT ARCHITECTURAL VISION
   • 1.1 Cybersecurity Context & Modern Security Challenges
   • 1.2 Multi-Format Hybrid Design Philosophy (Multi-Format Tri-Layer Engine)
   • 1.3 V1.6 Core Technical Specifications Table (Technical Highlights)
2. ARCHITECTURE DIAGRAM & OVERALL DATA PROCESSING FLOW
3. SUBSYSTEM 1 DETAILS: DYNAMIC WINDOWS SANDBOX & STEALTH MONITORING (RING-3)
   • 3.1 Isolated Virtualized Desktop Environment & Windows Job Object Limits
   • 3.2 Stripping Dangerous Privileges with Restricted Token
   • 3.3 Anti-Evasion & Stealth Techniques (PEB Unlinking, Memory PE Wiping, DACL Guard)
   • 3.4 Native NT API Interception via MinHook Engine & RAII HookGuard
   • 3.5 2-Layer Copy-On-Write (COW) Technology for Filesystem & Registry
   • 3.6 Kernel Event Tracing (ETW Monitor)
   • 3.7 Fake Network Engine (C2 Sinkhole & Payload Mocking)
   • 3.8 Intel Processor Trace (Intel PT) Hardware Monitoring Engine
   • 3.9 Technical Boundaries & Practical Limitations of the Analysis Environment
4. SUBSYSTEM 2 DETAILS: STATIC PE ANALYZER & CAPSTONE DISASSEMBLER
   • 4.1 PE Structure Analysis, Section Entropy & Anomaly Detection
   • 4.2 Opcode N-Grams Decoding & TF-IDF Weighting
   • 4.3 API Call N-Grams & Control Flow Graph (CFG)
   • 4.4 Packer Detection & Automatic Unpacking (UPX / WWPack Unpacker)
   • 4.5 Advanced YARA Rule Auto-Generation (YaraGen - Rust Noise Filtering) & Fuzzy Hashing
5. SUBSYSTEM 3 DETAILS: MULTI-FORMAT ENGINE & NATIVE C++ PDF ANALYZER V2.0
   • 5.1 3-Stage File Router (FileRouter Engine)
   • 5.2 Native C++ PDF Analysis Engine V2.0 (Analyzers/PDF/)
   • 5.3 Hierarchical Recursive Analysis Tree (AnalysisNode Architecture)
   • 5.4 Contextual Risk Scoring Engine & Child Dominance Rule
   • 5.5 Anti-DoS Defense & Decompression Bomb Protection
   • 5.6 Evidence-Based MITRE ATT&CK Mapping & Universal IOC Defanger
   • 5.7 Universal Schema 2.0 Output Report Standardization
6. SUBSYSTEM 4 DETAILS: 3-TIER DATASET & FALSE-POSITIVE-RESISTANT PDF AI PIPELINE
   • 6.1 3-Layer Dataset Tiered Structure (dataset/pdf/)
   • 6.2 Eliminating the "False Positive Machine" Inference Shortcut via Hard Negatives
   • 6.3 Multi-Level Deduplication Before Splitting
   • 6.4 Leakage-Resistant Independent Set Splitting with StratifiedGroupKFold
   • 6.5 57-Feature Vector & Probability Calibration (CalibratedClassifierCV)
   • 6.6 Validation Benchmark Results & False-Alarm Resistance (Audit Report)
7. SUBSYSTEM 5 DETAILS: MACHINE LEARNING & AI ENSEMBLE (PE & GNN & SHAP)
   • 7.1 Unified Multi-Dimensional Feature Space (Feature Vectorization)
   • 7.2 PyTorch API Sequence Embedder & Control Flow Graph GNN
   • 7.3 Feature Optimization via SHAP Feature Pruning
   • 7.4 LightGBM Ensemble Classifier Model (Adam, Eve, Marcus) & Dynamic Thresholds
   • 7.5 Benchmark Results & Empirical Evaluation of the AI Classifier
8. SUBSYSTEM 6 DETAILS: BHR ENGINE (RANSOMWARE DETECTOR & KEY RECOVERY)
   • 8.1 High-Entropy Encryption Detection Algorithm (Shannon Entropy Rate)
   • 8.2 Burst Modification Rate Monitoring & Shadow Copy Deletion Behavior
   • 8.3 Extracting Encryption Key Structures (20+ Standards) from RAM & pagefile.sys
   • 8.4 Data Recovery from COW Virtual Overlay Buffer (Win32/NT Scope)
   • 8.5 Crypto Timeline Log & Data Transformation Map
   • 8.6 Empirical Testing of Dual-Engine Hybrid Ransomware Memory Key Extraction
   • 8.7 Recovery Engine Registry & Crypto Dataflow Tracker Architecture
9. SUBSYSTEM 7 DETAILS: BEHAVIOR CORRELATOR & BEHAVIORGRAPH ENGINE V1.6
   • 9.1 Multi-Source Event Normalization (Userland Hooks + Kernel ETW)