Xylent
- A powerful antivirus built using Electron framework and python
Added Features
- Real Time System Watch
- Database based quering(md5, sha1, sha256, ssdeep and tlsh)
- Yara based pattern matching analysis
- Machine learning AI module
- Executable file signature and integrity analysis
- Quarantine Handler
- Startup Items Management
- Configurable Quick Settings
- Basic Scans -> Quick
Xylent Interface

Features Demonstration
Real Time Protection Demo:
- Xylent is capable of detecting and removing Malware
- Blocks drive by downloads
- Prevents malware replication
- Blocks malware on file opening,renaming as well as copying
- Detects newly opened files
https://github.com/Rutuj-Runwal/Xylent/assets/59436520/38a76c6f-3bbe-49d7-baa0-c386d96e6492
Quarantine Management Demo:
- Objects detected are placed into a secure quarantine folder
- Xylent's UI provides a simple interface to restore or safely remove the files
https://github.com/Rutuj-Runwal/Xylent/assets/59436520/86a85662-251d-4d20-a478-055ec5490222
Archive Auto Repair
- Automatically repair's archive containing malicious files
- Repairs infected files and keeps important data in the archive safe
https://github.com/Rutuj-Runwal/Xylent/assets/59436520/9a5dda8e-2817-4ce4-b570-9799817dc2f8
Startup monitor Demo:
- Xylent monitors startup items for potential malware
- Currently uses baseline unusual characters and patterns in processname of startup IOC's
- Enable/Disable startup items directly via Xylent's UI
https://github.com/Rutuj-Runwal/Xylent/assets/59436520/99a0af23-0e1e-4f5e-abcc-c7daffc8774f
Expected Features/Coming Soon
- Intelligent/Smart cleaning
- Cache cleaner -> temp,prefetch, Browser cache...
- Automatically apply recommended OS settings
- File Insights: VirusTotal based quering,
- Web Insights: whois lookup for inbound/outbound urls, virustotal / McAfee siteadvisor
- Basic Scans --> Full,Custom,Memory based scans
Ambitious/Nice-To-Haves' Features
- Vulnerability Scanner [CVE lookup]
- MITRE ATT&CK report for threats
- In process interruption of malware execution
- [LINUX] ClamAV integration
- File entropy and ML based Heuristic
- AI based malicious pattern detection
- IDS/IPS & HIPS
Tech Stack:
- Python
- ElectronJS
- ReactJS
- Webpack/babel
npm i
npm run watch
python engine.py
npm start
Architecture
- Flask backend: run using
python engine.py
- Electron based frontend built on ReactJS
npm install
to install dependencies
npm run watch
to compile using webpack
- Finally
npm start
to run the app
### Target Environment
- Currently in development with main focus towards Windows x64 systems
- Requires Administrator privilages for certain features
- Extending capabilites towards Linux at a later stage
Acknowledgements and References
- Use signature base by Florian Roth under Detection Rules license for additional detection capabitiies. Place the yare rules in
/backend/signature-base/yara/
- Custom simple "Dummy" yara rules - ruleA & ruleB to detect test malware( of type .docx and .pdf) designed specifically for Xylent Antivirus
Credits