mirror of
https://github.com/NirvanaOn/AntiVE-BehaviorWatch
synced 2026-07-15 03:40:25 +00:00
Nirvana
1f6c04a3ac
Added detailed project description, architecture, behavioral features, and features for AntiVE-BehaviorWatch.
108 lines
3.1 KiB
Markdown
108 lines
3.1 KiB
Markdown
# AntiVE-BehaviorWatch
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<img width="1408" height="768" alt="AntiVE_BehaviorWatch" src="https://github.com/user-attachments/assets/09bc71d0-f1b3-4231-b9de-75c387484072" />
|
|
|
|
|
|
> **Embedded AI-powered human behavior verification for cybersecurity research.**
|
|
|
|
---
|
|
|
|
# What is AntiVE-BehaviorWatch?
|
|
|
|
**AntiVE-BehaviorWatch** is a Windows-based cybersecurity research project that explores a new approach to execution control using **embedded artificial intelligence**.
|
|
|
|
Instead of relying on traditional anti-analysis techniques such as virtual machine detection, sandbox detection, debugger checks, or hardware fingerprinting, the project uses an embedded **GRU (Gated Recurrent Unit) neural network** to determine whether a **real human** is interacting with the system.
|
|
|
|
The model analyzes real-time mouse behavior—including cursor movement, velocity, acceleration, jerk, angular velocity, idle patterns, and motion characteristics—to make an intelligent runtime decision before allowing the protected execution path to continue.
|
|
|
|
---
|
|
|
|
<img width="1919" height="1035" alt="AntiVE" src="https://github.com/user-attachments/assets/4e5fd10f-2241-4c3e-9847-f6f84ad23298" />
|
|
|
|
---
|
|
|
|
# Architecture
|
|
|
|
```
|
|
Mouse Movement
|
|
│
|
|
▼
|
|
Feature Extraction
|
|
│
|
|
▼
|
|
Embedded GRU Neural Network
|
|
│
|
|
▼
|
|
Behavior Classification
|
|
│
|
|
┌─────┴────────┐
|
|
│ │
|
|
▼ ▼
|
|
Human Idle / Artificial
|
|
Verified Behavior
|
|
│ │
|
|
▼ ▼
|
|
Continue Abort
|
|
Execution
|
|
|
|
```
|
|
|
|
---
|
|
|
|
# Behavioral Features
|
|
|
|
The embedded model analyzes multiple behavioral features:
|
|
|
|
- Cursor Distance
|
|
- Cursor Velocity
|
|
- Acceleration
|
|
- Jerk
|
|
- Mouse Angle
|
|
- X-axis Movement
|
|
- Y-axis Movement
|
|
- Idle State
|
|
- Idle Streak Length
|
|
|
|
These features are collected continuously over multiple observation phases before inference.
|
|
|
|
---
|
|
|
|
# Features
|
|
|
|
- Embedded GRU neural network
|
|
- Offline AI inference
|
|
- No external AI runtime required
|
|
- Real-time behavioral telemetry
|
|
- Human interaction verification
|
|
- Multi-phase analysis
|
|
- Majority voting decision engine
|
|
- Lightweight C implementation
|
|
- Windows-native application
|
|
- Embedded model weights
|
|
- Runtime behavior classification
|
|
|
|
---
|
|
|
|
# Disclaimer
|
|
|
|
This project is intended **strictly for cybersecurity research, machine learning experimentation, education, and authorized security testing**.
|
|
|
|
It demonstrates how embedded AI can be used for behavioral verification and runtime decision-making. It is not intended for unauthorized or malicious use.
|
|
|
|
---
|
|
|
|
# Author
|
|
|
|
**Nirvana (0xNirSec)**
|
|
|
|
*"Trust behavior, not the environment."*
|
|
|
|
|