Canary Files: Ransomware Early-Detection Simulator

Ransomware wins by racing: encrypt as much of a file system as possible before anyone notices. This simulator scatters a handful of harmless canary (decoy) files among a visualized tree of real files, then runs the same simulated scan-and-encrypt attack against two identical systems side by side — one undefended, one watching its canaries. The moment the defended system's scan touches any canary file, the attack is killed instantly; the undefended system simply runs to completion. Tune canary density, scan speed and file-system size to see how a handful of trip-wires reshapes the damage curve.