Coursework · Jan — Apr 2023 · IIT Jodhpur
Virus detection engine
A Windows-native malware detection prototype with signature scanning, heuristic analysis and quarantine for suspicious processes.
- Role
- Systems programmer
- Timeline
- Jan — Apr 2023
- Type
- Coursework, public repo
- Stack
- C/C++, Microsoft Detours, SHA-256, Win32
96%Detection rateOn a curated virus corpus during evaluation
<1%False positivesAfter heuristic tuning and whitelist support
01Context
A fast detection prototype to explore real-time malware interception without access to enterprise antivirus tooling.
02Approach
Hash-based scanning combined with API hooking, so signature checks run alongside behavioural heuristics.
- Developed a multi-threaded scanning core using memory-mapped files for signature throughput.
- Hooked critical Win32 APIs with Microsoft Detours to observe file and registry operations in real time.
- Wrote the heuristic scoring and quarantine workflow with a CLI reporting dashboard.
03Impact
Reliable detection in academic evaluation and a foundation for further research.
- 120k signature comparisons per second on the benchmark dataset.
- A sandbox simulator that replays malware behaviour for detection tuning.
- Exportable incident reports for security teams.