BackdoorGuard

️ BackdoorGuard — Advanced Plugin Security Scanner
Protect your Minecraft server from suspicious plugins, hidden backdoors, and potentially malicious code.

BackdoorGuard is a security-focused plugin designed to help server administrators inspect plugin JAR files, identify suspicious code patterns, monitor plugin directory changes, and audit potential security risks.

It combines static class-file analysis, suspicious behavior detection, hash verification, archive inspection, and runtime monitoring to help administrators investigate plugins that may compromise their servers.

BackdoorGuard is a detection and auditing tool — it does not automatically delete or disable plugins.

✨ Features
Advanced JAR Scanning

• Scan plugin JAR files for suspicious Java class references, method calls, and embedded strings.
  
  
• Detect potentially dangerous combinations involving process execution, network communication, dynamic class loading, reflection, and privileged operations.
  
  
• Identify suspicious encoded data and indicators of hidden payloads.
  
  
• Inspect archive structures for duplicate entries, unusual paths, suspicious compression ratios, nested archives, and malformed content.
  
  
• Calculate SHA-256 hashes for plugin verification and trusted-file checks.
  

Correlation-Based Detection
BackdoorGuard evaluates combinations of suspicious indicators instead of relying exclusively on individual keywords.

Examples include:

• Process execution combined with network activity.
  
  
• Sensitive environment or file access combined with outbound communication.
  
  
• Dynamic code loading combined with suspicious reflection.
  
  
• Privilege-related operations combined with other suspicious behavior.
  

This approach helps prioritize findings that deserve investigation. Individual indicators are not proof of malicious activity.

⚡ Background Scanning & File Monitoring

• Perform scans in background workers to reduce impact on the server's main thread.
  
  
• Limit concurrent scanning and queued work.
  
  
• Cache scan results using file hashes to avoid unnecessary repeated analysis.
  
  
• Monitor the plugin directory for newly added, modified, or removed JAR files.
  
  
• Debounce file changes before scanning to reduce duplicate work.
  

Plugin Integrity & Runtime Auditing

• Audit loaded plugin information and reported code-source locations.
  
  
• Detect certain unexpected changes in plugin inventory.
  
  
• Inspect relevant JVM startup arguments for suspicious options.
  
  
• Monitor BackdoorGuard's own command and listener integrity.
  
  
• Help administrators investigate unexpected commands and privilege-related changes.
  

Multilingual Support
BackdoorGuard includes separate language files for:

• English (en)
  
  
• Vietnamese (vi)
  
  
• Spanish (es)
  
  
• Simplified Chinese (zh_CN)
  
  
• French (fr)
  
  
• German (de)
  
  
• Brazilian Portuguese (pt_BR)
  
  
• Russian (ru)
  
  
• Japanese (ja)
  
  
• Korean (ko)
  

Language files are separated for easier customization, and missing translations can fall back to English.

Administrative Tools
Use the /bguard command to access the available security and management functions.

Command Description
/bguard status View the current protection status.
/bguard scan Start a plugin scan.
/bguard reload Reload the configuration and language settings.
/bguard trust Manage trusted JAR files.
/bguard vl Inspect violation information.
/bguard cache clear Clear the scan-result cache.
/bguard audit Run or inspect available security audits.
Command availability and syntax may depend on the installed build.

⚙️ Installation

1. Download the BackdoorGuard JAR.
   
   
2. Place it in your server's plugins directory.
   
   
3. Start or restart your server.
   
   
4. Configure the plugin in plugins/BackdoorGuard/config.yml.
   
   
5. Review scan reports and investigate suspicious findings before taking action.
   

Recommended: Keep backups of your server and verify unfamiliar plugins before installing them on a production server.

Security Philosophy
BackdoorGuard is designed to support server administrators, not replace security review.

Legitimate plugins may use reflection, networking, dynamic class loading, or encoded data. Likewise, sophisticated malicious code may evade static detection. A detection result should therefore be treated as a security lead that requires further investigation.

BackdoorGuard does not guarantee detection of every backdoor or malware sample.

Compatibility
Designed for Minecraft server environments using Java 21 and the Paper/Spigot 1.21.x ecosystem. Verify compatibility with your exact server version and build before deploying it in production.

Feedback & Bug Reports
Found a false positive, suspicious file that was missed, or an unexpected behavior?

Please provide the server software and version, Java version, relevant configuration, and sanitized logs when reporting an issue.

BackdoorGuard — Inspect. Detect. Investigate. Protect.