AI Security Suite

NIDS — network intrusion detection

Turns packets into flows and scores them with several models, so no single model decides alone.

• pcap + live capture
• 53 flow features
• Majority vote

• Reads pcap files (streaming) or a live interface (Scapy AsyncSniffer, optional BPF filter).
• Builds bidirectional flows with TCP state summary (SF / S0 / REJ / RST / OTH) and a 30 s inactivity timeout.
• Window features over the last 2 seconds and last 100 connections — the same meaning as NSL-KDD count / srv_count / serror_rate.
• Each model scores “bigger = riskier”; an alert fires when at least min_votes models agree (default: majority).
• Alerts carry severity (high = all models agree), an attack-type hint (SYN flood, port scan, host sweep, UDP flood, brute force, statistical anomaly) and key feature values.

HIDS — host log anomaly detection

Learns what normal auth.log / syslog looks like on your host and flags what is new or bursty.

• auth.log / syslog
• 26 features
• Isolation Forest

• Features include time of day (sin/cos), message-template rarity, 13 security keywords and per-IP 60-second window counts of events, failures and tried accounts.
• Threshold = 99th percentile of normal training-log scores (configurable).
• Each alert lists its top contributing features, e.g. ip_fail_window → brute force.
• Train on a period you believe attack-free; days to weeks of logs are recommended.

Malware scanner

Static, rule-based, reputation and behavior signals combined into one explainable verdict — without ever running the file.

• PE · XGBoost · SHAP
• YARA
• VirusTotal (hash only)

• Static ML on 55 PE features; SHAP values show which features pushed the score up or down.
• YARA rules from a folder (7 example rules included: EICAR, UPX, high entropy, injection APIs, ransom strings, encoded PowerShell, unsigned).
• Dynamic analysis reads only the report.json produced by an external sandbox (Cuckoo/CAPE).
• Overall score = max(signal × weight); ≥ 0.8 malicious, ≥ 0.5 suspicious, otherwise clean. “Clean” means no evidence found — not a guarantee.
• Only PE files are ML-analyzed; scripts, documents and ELF get YARA and VirusTotal only.

Real-time pre-emptive defense

v1.1 adds an engine that receives threats, decides by policy and responds — with the brakes on by default.

• 5 input sources
• 6 response types
• Dry-run default

• Inputs: scapy sniffing, pcap replay, /proc/net/tcp poller, auth.log tail, file watch (watchdog) feeding the existing malware scanner.
• Responses: IP block (nft / iptables / netsh, TTL, allowlist), rate limit, file quarantine, process kill and account lock (both off by default), alert.
• Policy examples: port scan 75 → immediate block; user enumeration 40 → alert only; SSH brute force 80; SYN flood 90; malicious file 100.
• Distributed or spoofed SYN floods are alert-only (syn_flood_target) so victims are not blocked by mistake.
• Operations: list-blocks, unblock, rollback, gc, restore, verify-audit, self-test, simulate.

Monitoring UI & reports

See what the engine saw and did — and hand a readable report to management or auditors.

• Local web UI
• HTML · JSON · CSV · DOCX

• Dashboard built with the Python standard library only: no CDN, fonts or scripts from outside; refreshes every 5 s.
• Tiles, 60-minute trend, events by kind, top attacker IPs, risk scores, block list, quarantined files, recent events and audit records.
• Bound to 127.0.0.1 by default; any other address requires a token. Release/restore buttons need --allow-actions.
• Reports: daily, weekly (7 days) or custom period; HTML is self-contained with the audit-chain status; CSV neutralizes formula injection.