Q-Ray Vision

Kazakhstan's first AI antivirus: 9 ML models, 5-layer detection pipeline, anti-ransomware and anti-phishing (371K+ domains) protecting Kaspi, Halyk and eGov users on Windows 10/11.

Comment

Inspiration

Millions of people in Kazakhstan and Central Asia rely on foreign antivirus products that ignore local threats: phishing clones of Kaspi bank, Halyk, and eGov, regional malware campaigns, and ransomware hitting small businesses. When sanctions and licensing issues cut off major vendors, the region was left even more exposed. We decided to build the first homegrown AI antivirus — made in Kazakhstan, for Kazakhstan.

What it does

Q-Ray Vision is a full-featured AI antivirus for Windows 10/11:

  • 5-layer detection pipeline: Trust check → Hashing → Evidence collection → Static ML analysis → Dynamic sandbox (Unicorn Engine)
  • 9 ML models trained on the EMBER2024 dataset, running fully on-device via ONNX Runtime — no cloud required
  • Real-time protection with a kernel-mode driver and AMSI integration
  • Anti-phishing database of 371K+ domains (goal: 1M+), focused on clones of Kaspi, Halyk, eGov and other local services
  • Anti-ransomware behavioral protection and AES-256 encrypted quarantine

How we built it

The core is 150K+ lines of C++20 with a JS-based interface layer. Static analysis extracts PE features and feeds an ensemble of 9 ONNX models; suspicious samples are detonated in a lightweight CPU-emulation sandbox built on Unicorn Engine. The kernel-mode driver intercepts file system activity in real time, and AMSI integration catches script-based attacks.

Challenges we ran into

  • Keeping false positives under 0.5% while pushing detection above 95% — tuning the ensemble thresholds took many iterations
  • Writing a stable kernel-mode driver for Windows 11 without breaking system performance
  • Building a phishing dataset for local threats from scratch — no public feeds cover Kazakh banking clones

Accomplishments that we're proud of

  • Working MVP with real-time protection, used daily on our own machines
  • One of the first AI-first antivirus engines developed in Central Asia
  • A team of 4 from Semey, Kazakhstan, competing in a market dominated by global giants

What we learned

Shipping security software solo teaches you everything at once: ML ops, Windows internals, UX for non-technical users, and how to make an ML ensemble run fast on an average home laptop.

What's next for Q-Ray Vision

During Build Week we're using Codex to accelerate development: refactoring the C++20 core, building an automated ML model update pipeline, and shipping the user dashboard. Next milestones: 1M+ phishing domains, public beta with 500+ users, and B2B pilots with local businesses.

Built With

Share this project:

Updates