DigiKavach: A Multistage Malware Detection System

With the exponential rise in cyber attacks, the traditional antivirus software that relies on signatures is becoming increasingly ineffective to counter the threats. This paper introduces DigiKavach, a multi-stage malware detection solution that combines static analysis and machine learning, dynamic sandboxing using Oracle VirtualBox, and behavioral monitoring for 72 hours within Windows systems. The system utilizes static analysis of PE files using pefile and lief, entropy analysis, string extraction, and rule-based detection with YARA in its static phase. The dynamic phase involves isolation, sandboxing, and API-call monitoring using Oracle VirtualBox, while behavioral monitoring is implemented by watching the file-system for up to three days using psutil. A PySide6 GUI interface and Telegram bot provide remote administration. With testing on a set of twelve labeled executable files, the proposed system demonstrates a detection accuracy of 91.7%, detection rate of 83.3%, and zero false positives.