rfxn/linux-malware-detect
Linux Malware Detect
Linux Malware Detect is a security platform designed for Linux server environments to identify and isolate malicious files. It functions as a multi-engine scanner that utilizes signature-based detection, heuristic analysis, and pattern matching to maintain system integrity. The tool provides automated auditing and real-time monitoring to detect unauthorized modifications as they occur.
The system distinguishes itself through kernel-level event monitoring, which triggers immediate scans upon file changes, and checkpoint-based scan resumption, which allows long-running operations to pause and restart without redundant processing. It manages threat containment by moving suspicious files into isolated quarantine storage, preventing execution while preserving them for forensic review.
Beyond core detection, the platform includes comprehensive incident response capabilities, such as asynchronous alert dispatching across multiple communication channels and the ability to export scan summaries for external monitoring. It supports modular threat feed synchronization to ensure the local detection engine remains updated against emerging threats.
Features
- Linux Malware Scanners - Scans Linux filesystems for malicious content using multiple detection engines to identify and isolate threats.
- Inotify-Based Watchers - Hooks into kernel-level filesystem notifications to trigger immediate security scans upon file modifications.
- Malware Scanning - Identifies malicious files by comparing system contents against a database of known threat signatures and heuristic patterns.
- Malware Quarantines - Isolates suspicious files into a restricted directory structure to prevent execution while preserving them for forensic review.
- Real-Time File Scanners - Monitors filesystem activity in real-time using kernel events to detect and scan new or modified files for malicious content.
- Linux Security Tools - Provides a system-level threat detection platform with automated scanning, file quarantine, and multi-channel alerting.
- Feed Integrations - Synchronizes external threat signature databases to keep the local detection engine updated against emerging security threats.
- Automated Audit Schedulers - Schedules recurring system-wide security audits and generates detailed reports to maintain system integrity.
- Security Scan Schedulers - Automates system security checks on a recurring schedule to identify and isolate malicious files.
- Scan State Persistence - Maintains persistent state records during filesystem traversals to allow long-running scans to resume without redundant processing.
- YARA-Based Scanning - Leverages YARA rules and MD5 signatures to scan Linux filesystems for known threats and unauthorized modifications.
- Threat-Based Scanning - Inspects files during transit or upload to identify malicious content using threat-based scanning patterns.
- Storage Isolation - Moves suspicious files into restricted directory structures to prevent execution while preserving them for forensic review.
- File Content Signature Matching - Executes sequential detection passes using hash comparisons and pattern matching to identify malicious code within files.
- Quarantine Management - Isolates suspicious files into secure directories to prevent execution while providing tools for review and restoration.
- Alert Notification Systems - Dispatches automated notifications about detected threats to messaging platforms and logging systems.
- Alerting and Incident Management - Dispatches automated notifications about detected threats to facilitate rapid incident response.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
