Security | Aegis Guard

Multi-Layer Defense Architecture

Each layer adds another barrier. Even if one is bypassed, the next catches what the first missed.

Layer 1

Signature-Based Detection

Compares file MD5 hashes against our continuously updated database of known malware signatures. Instant identification with zero false positives for catalogued threats.

MD5 Hashing CSV Signatures Instant Match

Layer 2

Pattern Recognition

Scans file byte sequences for known malicious patterns at specific offsets. Catches polymorphic variants that evade hash-based detection by matching behavioral byte signatures.

Byte Patterns Offset Matching Polymorphic

Layer 3

AI Heuristic Analysis

Our AI engine scores files 0–100 analyzing entropy levels, PE imports, suspicious strings, and structural anomalies. Catches zero-day threats that no signature database knows about.

Entropy Analysis PE Inspection Zero-Day

Layer 4

Real-Time Monitoring

Watchdog-powered filesystem observer watches for new and modified files in real time. Combined with USB drive monitoring that auto-scans any removable media the moment it's plugged in.

Watchdog USB Monitor Live Alerts

How the AI Scanner Works

01

Entropy Calculation

Shannon entropy measures randomness in file bytes. Packed, encrypted, or obfuscated malware shows entropy above 7.0 (max 8.0), while normal files average 4–6.

// Shannon entropy formula
H(X) = -Σ p(x) × log₂(p(x))

File: update.exe
Entropy: 7.84 ⚠ PACKED
Normal range: 4.0 – 6.5

02

PE Import Analysis

Inspects Windows PE executable imports for dangerous API calls. Functions like CreateRemoteThread and VirtualAllocEx indicate process injection attempts.

// Suspicious imports detected
⚠ CreateRemoteThread (+15)
⚠ VirtualAllocEx (+12)
⚠ WriteProcessMemory (+12)
Risk Score: +39

03

String Pattern Matching

Regex-powered scan for malicious indicators: hardcoded IP URLs, registry persistence keys, encoded PowerShell commands, and .NET download cradles.

// Suspicious strings found
⚠ powershell -enc (2×)
⚠ CurrentVersion\Run (1×)
⚠ http://192.168.x.x (3×)
Risk Score: +25

04

Verdict & Quarantine

All scores are combined. Files scoring ≥60 are flagged as Suspicious, ≥80 as Malicious. Detected threats are XOR-encrypted and moved to an isolated quarantine vault.

VERDICT: MALICIOUS (Score: 89/100)

→ File quarantined: trojan_loader.exe

→ XOR encrypted → .quarantine/

→ Entry logged to quarantine_log.json

Secure Isolation

Quarantine Vault

Detected threats don't just get deleted — they're XOR-encrypted and locked away in an isolated vault. Review, analyze, restore, or permanently destroy them on your terms.

XOR encryption prevents accidental execution
Full audit log with original paths & timestamps
One-click restore if a file is a false positive
Permanent deletion for confirmed threats

quarantine_vault.panel

⚠ Win32.Trojan.Dropper

setup_crack.exe — Score: 92

Critical

⚠ Suspicious.Packed.UPX

update_patch.exe — Score: 67

Medium

ℹ PUP.Adware.BundleInstaller

free_tool.exe — Score: 41

Low

Trusted by Thousands

"Aegis Guard caught a zero-day trojan that my previous antivirus completely missed. The AI heuristic scanner flagged it immediately with a score of 87. Impressive."

Marcus Chen

Security Researcher

"The quarantine vault is brilliant. I accidentally flagged a legit file, and the one-click restore brought it right back. No data loss, no hassle."

Sarah Kimura

IT Administrator

"Real-time USB monitoring saved us when a contractor plugged in an infected drive. Aegis Guard quarantined 3 threats before they could spread. Unreal speed."

David Nkomo

Network Engineer

Unbreakable Security