Skip to content

UI_GUIDE.md

Latest commit

 

History

History
348 lines (276 loc) · 10.8 KB

UI_GUIDE.md

File metadata and controls

348 lines (276 loc) · 10.8 KB

Malware Defense - User Interface Guide

Overview

The Malware Defense system features a comprehensive Windows Forms-based UI with multiple screens for monitoring, managing, and remediating threats.

UI Components

1. Splash Screen

Purpose: Initial loading screen shown during application startup

Features:

  • Professional branding with shield icon
  • Version information
  • Loading status indicator
  • 2-second display duration

2. Main Dashboard

Purpose: Central hub for system monitoring and threat overview

Features:

  • Header: Application title and version
  • System Status: Real-time protection status indicator
  • Statistics Cards:
    • Threats Detected (red card)
    • Threats Contained (orange card)
    • System Protected (green card)
  • Recent Threats List: Last 10 detected threats with:
    • Timestamp
    • Threat level (Critical/Malicious/Suspicious)
    • Process name
    • File location
    • Status
  • Action Buttons:
    • View All Threats
    • View Quarantine
    • Settings

Color Coding:

  • 🔴 Critical: Red background
  • 🟠 Malicious: Orange background
  • 🟡 Suspicious: Yellow background

Interactions:

  • Double-click threat to view details
  • Minimizes to system tray when closed
  • Auto-updates every second

3. Threat Details Form

Purpose: Detailed analysis and remediation options for individual threats

Features:

  • Comprehensive Threat Report:
    • File information (path, hash, process ID)
    • Signature details (signed, signer, Microsoft-signed)
    • Threat assessment (level, score, indicators)
    • Threat indicators with scores
    • Persistence mechanisms
    • Security recommendations

Action Buttons:

  • Quarantine: Move file to secure location (recommended)
  • Delete: Permanently remove file (dangerous)
  • Add to Whitelist: Mark as false positive
  • Close: Return to dashboard

Safety Features:

  • Cannot delete Microsoft-signed files
  • Confirmation dialogs for all actions
  • Automatic detection of locked files
  • Boot-time deletion for locked files
  • Offline remediation for System32 files

4. Threat Viewer

Purpose: Complete history of all detected threats

Features:

  • Toolbar:

    • Filter dropdown (All/Critical/Malicious/Suspicious)
    • Search box for finding specific threats
    • Refresh button
    • Export button (CSV/TXT)
    • Threat count display

  • Threat List:

    • Date/Time
    • Threat Level
    • Process Name
    • File Path
    • Score
    • Status
    • Hash

Interactions:

  • Double-click to view threat details
  • Export to CSV for reporting
  • Real-time filtering and search

5. Settings Form

Purpose: Configure detection and monitoring parameters

Tabs:

Detection Tab

  • Threat Level Thresholds:
    • Suspicious Threshold (default: 30)
    • Malicious Threshold (default: 50)
    • Critical Threshold (default: 80)
  • Containment Options:
    • Auto-contain detected threats (default: enabled)

Monitoring Tab

  • ETW Monitoring: Primary event source (default: enabled)
  • WMI Monitoring: Fallback monitoring (default: enabled)
  • Behavioral Monitoring: Clipboard/screen capture (default: enabled)

General Tab

  • Startup Options:
    • Start with Windows (default: disabled)
  • Notifications:
    • Show desktop notifications (default: enabled)

Action Buttons:

  • Save Settings
  • Cancel
  • Reset to Defaults

6. System Tray Icon

Purpose: Always-accessible system monitoring

Features:

  • Shield icon indicating protection status
  • Context menu:
    • Open Dashboard
    • View Quarantine
    • Exit
  • Double-click to open dashboard
  • Balloon notifications for threats

Notifications:

  • Suspicious: Info icon
  • Malicious: Warning icon
  • Critical: Error icon + modal dialog

User Workflows

Responding to a Threat Alert

  1. Notification Appears:

    • Balloon tip shows threat summary
    • Critical threats show modal dialog

  2. Review Threat:

    • Click notification or open dashboard
    • Double-click threat in list
    • Review detailed threat report

  3. Take Action:

    • Recommended: Click "Quarantine" to isolate file
    • If False Positive: Click "Add to Whitelist"
    • If Certain: Click "Delete" (requires confirmation)

  4. Verify:

    • Check system status returns to normal
    • Review quarantine folder if needed

Reviewing System Status

  1. Open dashboard from tray icon
  2. Check statistics cards for overview
  3. Review recent threats list
  4. Click "View All Threats" for complete history

Configuring Detection

  1. Open Settings from dashboard
  2. Navigate to Detection tab
  3. Adjust thresholds:
    • Lower values = more sensitive
    • Higher values = less sensitive
  4. Save settings
  5. Changes take effect immediately

Exporting Threat Data

  1. Open "View All Threats"
  2. Apply filters if needed
  3. Click "Export" button
  4. Choose format (CSV/TXT)
  5. Select save location
  6. Use for reporting or analysis

Keyboard Shortcuts

  • F5: Refresh threat list
  • Ctrl+S: Open settings
  • Ctrl+Q: View quarantine
  • Esc: Close current dialog
  • Enter: Confirm action

Visual Design

Color Scheme

  • Primary: Blue (#2980b9)
  • Success: Green (#27ae60)
  • Warning: Orange (#e67e22)
  • Danger: Red (#c0392b)
  • Background: Light gray (#f0f0f5)
  • Text: Dark gray (#2c3e50)

Typography

  • Font Family: Segoe UI
  • Headers: 16-20pt Bold
  • Body: 9-10pt Regular
  • Monospace: Consolas 9pt (for technical details)

Layout

  • Padding: 20px standard
  • Button Height: 35-40px
  • Card Spacing: 10px between elements
  • Border Radius: Flat design (no rounded corners)

Accessibility

  • High contrast color scheme
  • Large, readable fonts
  • Clear button labels
  • Keyboard navigation support
  • Screen reader compatible labels

Performance

  • Dashboard Updates: 1 second interval
  • Threat List: Maximum 10 recent items
  • Memory Usage: < 50MB for UI
  • Startup Time: < 2 seconds

Error Handling

Common Scenarios

  1. File Access Denied:

    • Shows error message
    • Suggests running as administrator
    • Offers boot-time deletion

  2. Quarantine Failed:

    • Displays specific error
    • Suggests alternative actions
    • Logs failure for review

  3. Settings Validation:

    • Prevents invalid threshold values
    • Shows clear error messages
    • Maintains previous valid settings

Tips & Best Practices

For Users

  1. Keep Dashboard Open: Monitor threats in real-time
  2. Review Regularly: Check threat history weekly
  3. Quarantine First: Don't delete immediately
  4. Export Reports: Keep records for compliance
  5. Adjust Thresholds: Tune for your environment

For Administrators

  1. Centralized Monitoring: Export logs for SIEM integration
  2. Whitelist Management: Document false positives
  3. Threshold Tuning: Start conservative, adjust based on false positive rate
  4. User Training: Educate on proper response procedures
  5. Regular Reviews: Audit quarantine and threat history

Troubleshooting

Dashboard Won't Open

  • Check if running as administrator
  • Verify .NET 8.0 is installed
  • Check Windows Event Log for errors

Threats Not Showing

  • Verify monitoring is enabled in settings
  • Check ETW/WMI services are running
  • Review forensic logs for detection events

High False Positive Rate

  • Increase detection thresholds in settings
  • Add legitimate software to whitelist
  • Review detection rules documentation

Performance Issues

  • Reduce update frequency
  • Disable behavioral monitoring if not needed
  • Close threat viewer when not in use

Future Enhancements

Planned UI improvements:

  1. Dark Mode: Theme toggle for low-light environments
  2. Charts & Graphs: Visual threat trends over time
  3. Real-time Monitoring: Live process tree view
  4. Advanced Filters: Complex query builder
  5. Customizable Dashboard: Drag-and-drop widgets
  6. Multi-language Support: Localization
  7. Remote Management: Web-based console
  8. Mobile Companion: iOS/Android monitoring app

Screenshots

Main Dashboard

┌─────────────────────────────────────────────────────────────┐
│ 🛡️ Malware Defense System                                   │
│ v1.0 - Professional EDR                                     │
├─────────────────────────────────────────────────────────────┤
│ ● System Status: ACTIVE                                     │
├─────────────────────────────────────────────────────────────┤
│ Statistics                                                  │
│ ┌──────────┐  ┌──────────┐  ┌──────────┐                  │
│ │ Threats  │  │ Threats  │  │ System   │                  │
│ │ Detected │  │Contained │  │Protected │                  │
│ │    5     │  │    5     │  │    ✓     │                  │
│ └──────────┘  └──────────┘  └──────────┘                  │
├─────────────────────────────────────────────────────────────┤
│ Recent Threats                                              │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Time     │ Level      │ Process  │ Location  │ Status  │ │
│ ├─────────────────────────────────────────────────────────┤ │
│ │ 14:23:15 │ 🔴 CRITICAL│ malware  │ C:\Temp\  │Contained│ │
│ │ 14:20:01 │ 🟠 MALICIOUS│ bad.exe  │ C:\Users\ │Contained│ │
│ └─────────────────────────────────────────────────────────┘ │
│ [View All] [Quarantine] [Settings]                         │
└─────────────────────────────────────────────────────────────┘

Support

For UI-related issues:

  • Check this guide first
  • Review IMPLEMENTATION_GUIDE.md
  • Submit bug reports with screenshots
  • Include steps to reproduce

Remember: The UI is designed for clarity and safety. Always review threat details before taking action.