87owo/PYAS

Antivirus software written in Python and C++ that blocks threats through Machine Learning and behavioral monitoring!

What it solves

PYAS is an antivirus software designed to block security threats using a combination of machine learning, behavioral monitoring, and signature-based detection.

How it works

The system operates across two primary layers:

  1. User Mode (Python/Web): A core application manages a web-based UI and coordinates several scanning engines. These engines use PE/ML scanning (via LightGBM and ONNX), YARA rules for heuristic detection, a cloud API for external verification, and signature verification.
  2. Kernel Mode (C++ Minifilter Driver): A low-level driver provides real-time protection by monitoring and intercepting system activities. It includes subsystems to protect the file system, processes, the registry, and the boot sector.

Communication between the user-mode application and the kernel-mode driver is handled via an ALPC port.

Who it’s for

Users looking for an open-source antivirus solution that integrates machine learning for threat detection and provides deep system-level protection on Windows.

Highlights

  • Hybrid Detection: Combines ML models (LightGBM), YARA rules, and cloud-based scanning.
  • Kernel-Level Protection: Uses a C++ minifilter driver to block unauthorized access to files, processes, and the registry.
  • Blockly Rule Editor: Includes a visual editor for creating driver protection rules.
  • Cross-Language Architecture: Integrates Python for high-level logic and C++ for low-level system hooks.

Related

  • Project
    cisco-ai-defense/mcp-scanner

    A security scanning tool for Model Context Protocol (MCP) servers and tools that uses YARA, LLMs, and Cisco AI Defense to detect malicious behavior and vulnerabilities.

  • Project
    cisco-ai-defense/skill-scanner

    A security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code using static analysis, behavioral dataflow, and LLM-based semantic analysis.

  • Project
    Pantheon-Security/medusa

    An AI-first security scanner with 40,000+ detection patterns to identify vulnerabilities in AI/ML apps, agents, and leaked secrets in AI chat histories.

  • Project
    luispedro/mahotas

    A fast Python computer vision library implemented in C++ that provides over 100 image processing algorithms operating on NumPy arrays.

  • Project
    nv-morpheus/Morpheus

    An open AI application framework for cybersecurity developers to build optimized pipelines for real-time IP traffic inspection and threat detection in data centers.