Process Anomaly Detection Script

Purpose

This script monitors processes on a system, extracts behavioral features, and uses machine learning (an Isolation Forest) to detect anomalous or potentially malicious behavior. When an anomaly is detected, it can take actions like suspending or terminating the process.

---

Key Features

Per-Process Feature Extraction

• CPU usage
• Memory usage
• I/O operations (read/write counts)
• Thread and file descriptor counts
• Network connections

Collected via psutil.

Data Storage

• Stores extracted features in an SQLite database (behavior.db)
• Maintains a rolling history of process features for training

Machine Learning

• Uses IsolationForest from scikit-learn to detect anomalous processes
• Retrains periodically using recent data
• Supports synthetic augmentation for training

Anomaly Handling

• Configurable actions on anomaly detection:
  • "suspend": temporarily stop the process
  • "kill": terminate the process
  • "log": record the anomaly only
• Suspends processes immediately if SUSPEND_ON_ANOMALY is enabled
• Can create a snapshot of metadata for quarantining

Configuration

• Paths for database and ML model
• Retrain interval (RETRAIN_INTERVAL_SEC)
• Minimum samples for training
• Rolling max rows for database to prevent overflow
• Contamination level for IsolationForest (CONTAMINATION)

Concurrency & Safety

• Uses threading (Thread) to run monitoring and retraining loops
• Lock and Event objects ensure safe access to the ML model and clean shutdown

---

High-Level Workflow

Initialization

1. Ensure the database table exists
2. Load or initialize the machine learning model

Monitoring Loop

1. Periodically scan all running processes
2. Extract behavioral features
3. Save features to SQLite

Detection

1. Predict if each process behavior is anomalous
2. If anomalous, take configured action (suspend, kill, or log)

Model Retraining Loop

1. Periodically retrain the Isolation Forest on recent feature data
2. Apply safe synthetic augmentation if needed
3. Save updated model

---

Summary

This script acts as a self-updating, process-level anomaly detector capable of automatically containing malware or suspicious behavior.