An AI-powered antivirus and system-defence platform for Windows.
Aria combines a real machine-learning PE classifier with YARA rules, hash signatures, certificate reputation and behavioural analysis, and pairs them with live network, ransomware, exploit and removable-storage protection all driven from a single local web UI and an embedded security assistant.
A LightGBM model trained on the full EMBER 2018 labelled set (300k benign / 300k malicious) and exported to ONNX. Holdout AUC 0.99755.
ML score, fuzzy/import hashing, YARA rules and Authenticode certificate reputation fused by an explicit precedence policy rather than a single signal.
Network reputation/IOC blocking, ransomware canaries and entropy analysis, exploit-chain detection, behavioural rules, and a port-scan / SYN-flood defence.
Real-time monitoring across the user profile and every attached fixed and removable drive USB sticks and external HDD/SSDs picking up drives plugged in later without a restart.
Tracks what each installer puts on the machine and, after an uninstall, shows the leftovers as a data tree and offers to remove them.
An embedded security assistant that runs without a model (deterministic command routing over real tools) and gets richer when a local GGUF is present. Destructive actions are confirmation-gated.
No single signal decides a verdict. Aria fuses six independent layers under an explicit precedence policy.
A Flask app on 127.0.0.1:8765 exposes REST routes and live Socket.IO events to a frameless shell. The UI is a pure client nothing in the engine knows how it is displayed. As a Windows service it runs as LocalSystem: protection starts before login and survives the window being closed.
Aria Security is in active development. Request early access or follow along as it ships.