System Architecture
4-Layer Protection Architecture
Layer 1: Qt Visualization GUI
trae_guardian_qt.exe - User interface for monitoring and management. Provides real-time process monitoring, threat alerts, and configuration options.
Layer 2: Core Modules
Configuration Center, Log Center (SQLite), AI Score Center. Manages system configuration, event logging, and risk scoring.
Layer 3: Detection Engine
ETW Monitoring, Handle Scanning, MBR Protection, Registry Protection, File Scanning, Network Audit. Detects threats at multiple levels.
Layer 4: Response & Rule Engine
Graded Response (8 levels), State Machine (6 states), Configurable Rule Engine, AI Risk Evaluation. Executes appropriate responses to detected threats.
Process Management
Process List
View all running processes with detailed information including PID, name, path, signer, parent process, and risk score.
Process Termination
Terminate single processes or entire process trees. Supports repeated termination for resilient malware.
Protected Processes
Critical system processes (lsass.exe, csrss.exe, wininit.exe, etc.) are hardcoded and unconditionally protected from termination.
Signature Verification
Windows Authenticode signature verification with caching (PID + image path as key). Signed processes are handled differently from unsigned processes.
State Machine
6-State Process Management
| State | Score Range | Description |
|---|---|---|
| Untrusted | 0-29 | New process, initial state |
| Observed | 0 | Under observation, no suspicious behavior |
| Suspicious | 30-49 | Exhibiting suspicious behavior |
| Restricted | 50-59 | Activities limited, close monitoring |
| Quarantined | 70-79 | Terminated and quarantined |
| Removed | 80+ | Terminated and files deleted |
State transitions are bidirectional, allowing processes to recover from lower-risk states if their behavior improves.
Configuration Management
Rules Configuration
Configurable rule engine with support for rule ID, weight, conditions, decay time, AI weight, and recoverability. Rules can be modified without recompilation.
Whitelist Management
Compiler and system tools (gcc.exe, cmd.exe, powershell.exe, etc.) are added to whitelist to prevent false positives during development activities.
Scoring Configuration
Behavior score and kernel score decay rates are configurable. Default is 1 point per minute decay.
Threshold Configuration
All scoring thresholds (observation, suspicious, restricted, quarantine, removal) are configurable via config.json.
Logging & Reporting
SQLite Logging
All events are logged to SQLite database for historical analysis and AI forensics. Logs include process information, threat detection details, and response actions.
Daemon Log
Detailed daemon.log file records all detection events, rule matches, process terminations, and system activities for debugging and auditing.
Log Search
Built-in log search functionality allows filtering and searching through event logs by process name, PID, time range, and threat type.
Statistics
Real-time statistics display including total threats detected, processes terminated, MBR restores performed, and false positive rate.
Network Monitoring
TCP/UDP Connection Logging
Monitors all TCP and UDP network connections established by processes. Logs include local and remote IP addresses, ports, and connection status.
DNS Resolution Auditing
Logs DNS resolution requests to detect suspicious domain lookups associated with malware command-and-control servers.
Network Statistics
Real-time network statistics including total connections, bytes transferred, and connection frequency per process.
Registry Protection
Critical Key Monitoring
Monitors modifications to critical registry keys including Run, RunOnce, Services, and Winlogon keys.
Registry Backup
Automatically backs up critical registry entries at startup for potential restoration if modifications are detected.
Unauthorized Change Blocking
Blocks unauthorized modifications to critical registry keys by unsigned processes.
Self-Protection
Process Protection
TRAE Guardian's own processes (trae_guardian_daemon.exe, trae_guardian_qt.exe, etc.) are protected from termination.
Mutual Protection
GUI and daemon processes monitor each other and restart if one is terminated.
File Protection
Installation directory is protected from modification or deletion by unauthorized processes.
Service Mode
Daemon runs as Windows Service with SYSTEM privileges, providing enhanced protection against tampering.