Tripwire (team 3)

Inspiration

We were inspired by the growing threat of ransomware attacks and wanted to explore how canary files can provide early attack detection. We were also wanting to build a practical cybersecurity defense tool.

What it does

Our products monitors canary files for unauthorized modifications or deletions as well as verifies file integrity using SHA-256 hashing. It also generates real time alerts with a risk score when suspicious activity is detected.

How we built it

The main tool we used to build our project was Python in VSCode. We also utilized Watchdog for real-time file monitoring and SHA-256 for integrity checks. Using such tools we were able to integrate monitoring, logging, and alerting into a single detection system.

Challenges we ran into

Some challenges we ran into were debugging file path and manifest issues across different environments. Another difficulty was synchronizing communication between monitoring and alerting components.

Accomplishments that we're proud of

We're proud of our hard work and collaboration in building the canary-based ransomware detection system that we built from scratch and successfully implemented into real time file monitoring.

What we learned

We learned various things including how ransomware attacks modify files and how canary files help detect them early. We also realized the importance of debugging and working as a team to integrate different software modules.

What's next for Tripwire (team 3)

Next, Tripwire could improve process attribution so it can identify ransomware more accurately across different operating systems. The project could also add a stronger real-time dashboard with incident history, alerts, and recovery controls for frozen processes. In the future, Tripwire could protect multiple folders or devices and use behavior-based detection to recognize suspicious encryption patterns before more files are affected.