Xray: A full-behavior-chain anti-malware system built in Go by a student

Hi HN,

I'm Tang Tian, a first-year economics student from a non-CS background, currently self-learning Go, OS concepts, and cybersecurity. Over the past weeks, I built Xray, an anti-malware and behavior tracing system from scratch, entirely in Go.

Xray compares your current system with a reference ISO, monitors real-time filesystem and process activity, detects suspicious behavior, automatically eliminates threats, and outputs a full behavior graph as a .dot file (Graphviz-ready).

Highlights:

Behavior chain detection (not signature-based)

Monitors full system with fsnotify + process tracing

Compares live system to boot ISO for anomaly detection

Auto-kills malicious behaviors in real time

Outputs behavior chain in .dot format (JSON/LOG planned)

Lightweight: compiled binary is only ~3MB

Written completely from scratch by a solo student

GitHub: https://github.com/lixiasky/X-ray There’s also a screenshot folder showing how it runs, and a personal note in the README.

This is open-source with a permissive license (MIT-style). Feel free to fork and build your own version—just please keep a credit line in the README: “First version by Xia Lixia.”

I hope someone finds this useful or fun to hack on. Feedback is welcome, and thank you for reading!

6 points | by tangtian 15 days ago

1 comments

  • 2rsf 13 days ago
    Please, please please choose a different name than xray. There are too many tools named xray, and it creates confusion
    [-]
    • tangtian 10 days ago
      Thank you for the reminder! I'm still new to all this and not very familiar with naming conventions. However, this tool has already been submitted under the name "X-RAY" in a provisional patent application to the USPTO, so it's difficult to change at this stage. I’ll definitely be more careful about naming in future projects. Thanks again for pointing it out!