Endpoint SecurityActive development

Aria Security

An AI-powered antivirus and system-defence platform for Windows.

Request Early AccessAll Products

Aria combines a real machine-learning PE classifier with YARA rules, hash signatures, certificate reputation and behavioural analysis, and pairs them with live network, ransomware, exploit and removable-storage protection all driven from a single local web UI and an embedded security assistant.

Highlights

What sets it apart.

Real ML detection

A LightGBM model trained on the full EMBER 2018 labelled set (300k benign / 300k malicious) and exported to ONNX. Holdout AUC 0.99755.

Four-layer file verdict

ML score, fuzzy/import hashing, YARA rules and Authenticode certificate reputation fused by an explicit precedence policy rather than a single signal.

Live protection

Network reputation/IOC blocking, ransomware canaries and entropy analysis, exploit-chain detection, behavioural rules, and a port-scan / SYN-flood defence.

All your drives

Real-time monitoring across the user profile and every attached fixed and removable drive USB sticks and external HDD/SSDs picking up drives plugged in later without a restart.

Sentinel Sense

Tracks what each installer puts on the machine and, after an uninstall, shows the leftovers as a data tree and offers to remove them.

Argus assistant

An embedded security assistant that runs without a model (deterministic command routing over real tools) and gets richer when a local GGUF is present. Destructive actions are confirmation-gated.

Detection

A layered detection engine.

No single signal decides a verdict. Aria fuses six independent layers under an explicit precedence policy.

  • ML EMBER 2381-dim features → LightGBM → ONNX, holdout AUC 0.99755.
  • Hash MD5 / SHA-256 signature sets.
  • Fuzzy import hashing + TLSH, degrading gracefully when unavailable.
  • YARA curated rule namespaces, user-extendable from the UI.
  • Certificate Authenticode via WinVerifyTrust, embedded and catalog signatures.
  • Fusion an explicit precedence policy over all of the above.
Protection

Protection that runs in real time.

  • Network reputation and IOC blocking.
  • Ransomware canaries and entropy analysis.
  • Exploit-chain detection and behavioural rules.
  • Port-scan / SYN-flood defence.
  • Real-time monitoring across every fixed and removable drive.
Architecture

A local service with a clean UI.

A Flask app on 127.0.0.1:8765 exposes REST routes and live Socket.IO events to a frameless shell. The UI is a pure client nothing in the engine knows how it is displayed. As a Windows service it runs as LocalSystem: protection starts before login and survives the window being closed.

  • Runs headless or as a desktop window.
  • Tamper-resistant quarantine and whitelist under ProgramData.
  • Secure vault, scan history, schedules and the Sense map kept locally.
Aria Security

Defence that respects your machine.

Aria Security is in active development. Request early access or follow along as it ships.

Request AccessAll Products