Upload 10 files

.gitignore

@@ -0,0 +1,43 @@
+@"
+# Python
+__pycache__/
+*.py[cod]
+*.so
+.Python
+env/
+venv/
+*.egg-info/
+dist/
+build/
+
+# Database files
+*.db
+*.sqlite
+*.sqlite3
+
+# Logs
+logs/*.log
+*.log
+
+# Models
+models/
+*.pkl
+
+# GeoIP database
+geoip/*.mmdb
+
+# Sensitive config
+config_local.py
+
+# IDE
+.vscode/
+.idea/
+*.swp
+
+# OS junk
+.DS_Store
+Thumbs.db
+
+# Temporary PCAP exports
+*.pcap
+"@ | Out-File -FilePath .gitignore -Encoding utf8

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GhostCmd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,3 +1,39 @@
----
-license: mit
----
+# MayOne Security Framework
+
+**AI‑powered Intrusion Detection & Response for Windows**
+
+![Dashboard Preview](docs/dashboard.png) 
+
+## Features
+
+- Real‑time packet capture (Scapy)
+- Rule‑based threat detection (port scan, brute force, DDoS, bursts)
+- AI anomaly detection (Isolation Forest) – learns normal traffic
+- Risk scoring (0–100) with threat levels: LOW, MEDIUM, HIGH, CRITICAL
+- Automatic IP blocking via Windows Firewall (inbound+outbound)
+- SQLite database for events, threats, blocked IPs, reports
+- Live Flask dashboard with:
+  - Traffic statistics
+  - Protocol distribution & top ports charts
+  - Recent threats table
+  - Manual IP block/unblock
+- Geo‑IP blocking (optional, MaxMind GeoLite2)
+- Scheduled & emergency PDF reports (with logo watermark)
+- PCAP export (full buffer)
+- Multithreaded, thread‑safe, low CPU usage
+
+## Requirements
+
+- Windows 10/11 (or Windows Server)
+- Python 3.10 or higher
+- Npcap (with WinPcap API compatibility) – [Download](https://npcap.com)
+- Administrator privileges (for sniffing and firewall changes)
+
+## Installation
+
+1. Clone the repository:
+   ```bash
+   git clone https://github.com/yourusername/MayOne-Security-Framework.git
+   cd MayOne-Security-Framework
+   pip install -r requirements.txt
+   python main.py

ai/anomaly_model.py

@@ -0,0 +1,47 @@
+import numpy as np
+from sklearn.ensemble import IsolationForest
+import pickle
+import os
+import threading
+
+class AnomalyModel:
+    def __init__(self, buffer_size=500):
+        self.model = None
+        self.feature_buffer = []
+        self.buffer_size = buffer_size
+        self.is_trained = False
+        self.lock = threading.Lock()
+
+    def _extract_features(self, packet_info):
+        size = packet_info['size']
+        proto = packet_info['protocol']
+        proto_map = {'TCP': 0, 'UDP': 1, 'ICMP': 2, 'OTHER': 3}
+        proto_code = proto_map.get(proto, 3)
+        return [size, proto_code]
+
+    def add_packet(self, packet_info):
+        feats = self._extract_features(packet_info)
+        with self.lock:
+            self.feature_buffer.append(feats)
+            if len(self.feature_buffer) >= self.buffer_size and not self.is_trained:
+                self._train()
+            return feats
+
+    def _train(self):
+        X = np.array(self.feature_buffer)
+        self.model = IsolationForest(contamination=0.1, random_state=42)
+        self.model.fit(X)
+        self.is_trained = True
+        print(f"[AI] Anomaly model trained on {len(X)} samples.")
+
+    def predict_anomaly_score(self, packet_info):
+        if not self.is_trained:
+            return 0.0
+        feats = self._extract_features(packet_info)
+        pred = self.model.predict([feats])[0]
+        if pred == -1:
+            score = -self.model.decision_function([feats])[0]
+            score = np.clip(score, 0, 1)
+        else:
+            score = 0.0
+        return score

ai/risk_scoring.py

@@ -0,0 +1,23 @@
+class RiskScorer:
+    def __init__(self, rule_weight=0.6, ai_weight=0.4):
+        self.rule_weight = rule_weight
+        self.ai_weight = ai_weight
+
+    def compute_risk(self, rule_threats, ai_anomaly_score):
+        if rule_threats:
+            max_rule_risk = max(score for _, score in rule_threats) / 100.0
+        else:
+            max_rule_risk = 0.0
+
+        combined = self.rule_weight * max_rule_risk + self.ai_weight * ai_anomaly_score
+        return min(100, int(combined * 100))
+
+    def threat_level(self, risk_score):
+        if risk_score >= 80:
+            return "CRITICAL"
+        elif risk_score >= 60:
+            return "HIGH"
+        elif risk_score >= 30:
+            return "MEDIUM"
+        else:
+            return "LOW"

config.py

@@ -0,0 +1,40 @@
+# Configuration file for MayOne Security Framework
+
+# Detection thresholds
+THRESHOLD = 0.6            # Risk threshold (0-1) above which action is taken
+TIME_WINDOW = 10           # Time window in seconds for burst/scan detection
+PORT_SCAN_THRESHOLD = 20   # Number of unique ports from one src in TIME_WINDOW
+BRUTE_FORCE_THRESHOLD = 10 # Number of failed-like packets (e.g., TCP to port 22/3389)
+DDoS_THRESHOLD = 100       # Packets per second from one src to trigger DDoS suspicion
+BURST_THRESHOLD = 50       # Packets in 1 second from one src
+
+# Response
+AUTO_BLOCK = True          # Automatically block IP via Windows Firewall
+LOG_LEVEL = "INFO"         # DEBUG, INFO, WARNING, ERROR
+REPORT_INTERVAL = 600      # Seconds between automatic reports (10 minutes)
+
+# Network interface to sniff (use None for default)
+NETWORK_INTERFACE = None   # e.g., "Ethernet" or "Wi-Fi"
+
+# Dashboard
+DASHBOARD_HOST = "127.0.0.1"
+DASHBOARD_PORT = 5000
+
+# Database
+DB_PATH = "database/security_events.db"
+
+# Whitelisted private IP ranges (CIDR)
+PRIVATE_RANGES = [
+    "127.0.0.0/8",
+    "10.0.0.0/8",
+    "172.16.0.0/12",
+    "192.168.0.0/16",
+]
+
+# GeoIP blocking
+ENABLE_GEOIP_BLOCK = True          # Default state (can be toggled from dashboard)
+GEOIP_DB_PATH = "geoip/GeoLite2-Country.mmdb"
+HIGH_RISK_COUNTRIES = ["RU", "CN", "KP", "IR", "SY", "UA", "AF", "IQ", "LY", "SO"]
+
+# PCAP export
+PCAP_BUFFER_SIZE = 10000            # Max number of raw packets to keep

main.py

@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+import threading
+import queue
+import time
+import logging
+import signal
+import sys
+import ipaddress
+from config import *
+from database.db import Database
+from monitor.packet_sniffer import PacketSniffer
+from detection.threat_detector import ThreatDetector
+from ai.anomaly_model import AnomalyModel
+from ai.risk_scoring import RiskScorer
+from response.block_ip import block_ip_windows
+from reports.report_generator import ReportGenerator
+from dashboard.app import run_dashboard
+from geoip.blocker import GeoIPBlocker
+
+logging.basicConfig(
+    filename='logs/system.log',
+    level=getattr(logging, LOG_LEVEL),
+    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
+)
+console = logging.StreamHandler()
+console.setLevel(logging.INFO)
+logging.getLogger('').addHandler(console)
+
+# Global variable that can be toggled from dashboard
+geoip_enabled = ENABLE_GEOIP_BLOCK
+
+def is_private_ip(ip):
+    try:
+        addr = ipaddress.ip_address(ip)
+        for cidr in PRIVATE_RANGES:
+            if addr in ipaddress.ip_network(cidr):
+                return True
+        return False
+    except:
+        return False
+
+class MayOneEngine:
+    def __init__(self):
+        self.packet_queue = queue.Queue(maxsize=10000)
+        self.db = Database()
+        self.sniffer = PacketSniffer(self.packet_queue, NETWORK_INTERFACE, PCAP_BUFFER_SIZE)
+        self.detector = ThreatDetector(TIME_WINDOW, PORT_SCAN_THRESHOLD,
+                                       BRUTE_FORCE_THRESHOLD, DDoS_THRESHOLD, BURST_THRESHOLD)
+        self.anomaly_model = AnomalyModel()
+        self.scorer = RiskScorer()
+        self.reporter = ReportGenerator(self.db)
+        self.geoip = GeoIPBlocker() if ENABLE_GEOIP_BLOCK else None
+        self.running = True
+        self.last_report_time = time.time()
+        self.recently_blocked = set()
+
+    def start(self):
+        logging.info("Starting MayOne Security Framework")
+        self.sniffer.start()
+        dash_thread = threading.Thread(target=run_dashboard, args=(DASHBOARD_HOST, DASHBOARD_PORT, self.sniffer), daemon=True)
+        dash_thread.start()
+        while self.running:
+            try:
+                packet = self.packet_queue.get(timeout=1)
+                self.process_packet(packet)
+            except queue.Empty:
+                self.check_auto_report()
+                continue
+            except Exception as e:
+                logging.error(f"Main loop error: {e}", exc_info=True)
+
+    def process_packet(self, packet):
+        global geoip_enabled
+        src_ip = packet['src_ip']
+        
+        # GeoIP blocking check (if enabled)
+        if geoip_enabled and self.geoip and not is_private_ip(src_ip):
+            if self.geoip.is_high_risk(src_ip):
+                logging.info(f"GeoIP high-risk country detected: {src_ip}")
+                if AUTO_BLOCK and src_ip not in self.recently_blocked:
+                    if block_ip_windows(src_ip, "GeoIP high-risk country"):
+                        self.db.insert_blocked_ip(src_ip, "GeoIP auto-block")
+                        self.recently_blocked.add(src_ip)
+                        action = "GEO_BLOCKED"
+                        self.db.insert_event(src_ip, packet['dst_ip'], packet['protocol'],
+                                             packet['port'], packet['size'], "GEOIP_RISK", 90, action)
+                        self.db.insert_threat(src_ip, "GEOIP_RISK", 90, f"Country: high-risk")
+                        return  # skip further processing
+
+        # Normal AI + rule detection
+        anomaly_score = self.anomaly_model.predict_anomaly_score(packet)
+        rule_threats = self.detector.detect(packet)
+        risk = self.scorer.compute_risk(rule_threats, anomaly_score)
+        threat_level = self.scorer.threat_level(risk)
+        action = None
+
+        if risk >= THRESHOLD * 100 and AUTO_BLOCK and not is_private_ip(src_ip):
+            if src_ip not in self.recently_blocked:
+                if block_ip_windows(src_ip, f"{threat_level} risk {risk}"):
+                    self.db.insert_blocked_ip(src_ip, f"{threat_level} risk")
+                    self.recently_blocked.add(src_ip)
+                    action = "BLOCKED"
+
+        threat_type = rule_threats[0][0] if rule_threats else None
+        self.db.insert_event(
+            src_ip, packet['dst_ip'], packet['protocol'],
+            packet['port'], packet['size'], threat_type, risk, action
+        )
+        if threat_type or anomaly_score > 0.3:
+            self.db.insert_threat(src_ip, threat_type or "ANOMALY", risk,
+                                  f"Anomaly={anomaly_score:.2f}")
+
+        if threat_level == "CRITICAL":
+            logging.warning(f"CRITICAL threat from {src_ip} - generating emergency report")
+            threading.Thread(target=self.reporter.generate_report, args=("critical_threat",)).start()
+
+        self.anomaly_model.add_packet(packet)
+
+    def check_auto_report(self):
+        if time.time() - self.last_report_time >= REPORT_INTERVAL:
+            logging.info("Generating scheduled report")
+            self.reporter.generate_report("scheduled")
+            self.last_report_time = time.time()
+
+    def shutdown(self):
+        logging.info("Shutting down MayOne Security Framework")
+        self.running = False
+        self.sniffer.stop()
+        self.db.close()
+        sys.exit(0)
+
+if __name__ == "__main__":
+    engine = MayOneEngine()
+    signal.signal(signal.SIGINT, lambda sig, frame: engine.shutdown())
+    engine.start()

requirements.txt

@@ -0,0 +1,9 @@
+scapy==2.5.0
+pandas==2.0.3
+numpy==1.24.3
+scikit-learn==1.3.0
+flask==2.3.3
+reportlab==4.0.4
+waitress==2.1.2
+geoip2==4.8.1
+maxminddb==2.6.2

test_framework.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+import os
+import sys
+sys.path.append('.')
+from database.db import Database
+from detection.threat_detector import ThreatDetector
+from ai.risk_scoring import RiskScorer
+from reports.report_generator import ReportGenerator
+
+def test_db():
+    db = Database()
+    db.insert_event("192.168.1.100", "8.8.8.8", "TCP", 443, 1500, "TEST", 50, None)
+    events = db.get_recent_events()
+    assert len(events) >= 1
+    print("[OK] Database works")
+
+def test_detector():
+    det = ThreatDetector(time_window=10, port_scan_th=3)
+    packets = [
+        {'src_ip': '1.2.3.4', 'port': 80, 'timestamp': 100},
+        {'src_ip': '1.2.3.4', 'port': 81, 'timestamp': 101},
+        {'src_ip': '1.2.3.4', 'port': 82, 'timestamp': 102},
+        {'src_ip': '1.2.3.4', 'port': 83, 'timestamp': 103},
+    ]
+    for p in packets:
+        threats = det.detect(p)
+    assert any(t[0]=='PORT_SCAN' for t in threats)
+    print("[OK] Threat detector works")
+
+def test_risk_scorer():
+    scorer = RiskScorer()
+    risk = scorer.compute_risk([('PORT_SCAN', 80)], 0.5)
+    assert 0 <= risk <= 100
+    print("[OK] Risk scoring works")
+
+def test_report(db):
+    gen = ReportGenerator(db)
+    paths = gen.generate_report("test")
+    for p in paths:
+        assert os.path.exists(p)
+    print("[OK] Report generation works")
+
+if __name__ == "__main__":
+    test_db()
+    test_detector()
+    test_risk_scorer()
+    db = Database()
+    test_report(db)
+    print("All tests passed.")

test_simulator.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+import time
+import random
+from scapy.all import IP, TCP, UDP, send
+
+def port_scan(target_ip="127.0.0.1", ports=range(1, 100)):
+    print(f"[SIM] Port scanning {target_ip}...")
+    for port in ports:
+        pkt = IP(dst=target_ip)/TCP(dport=port, flags="S")
+        send(pkt, verbose=False)
+        time.sleep(0.01)
+
+def brute_force(target_ip="127.0.0.1", port=22, attempts=50):
+    print(f"[SIM] Brute force simulation on {target_ip}:{port}")
+    for i in range(attempts):
+        pkt = IP(dst=target_ip)/TCP(dport=port, flags="S")
+        send(pkt, verbose=False)
+        time.sleep(0.05)
+
+def ddos_flood(target_ip="127.0.0.1", duration=5, rate=200):
+    print(f"[SIM] DDoS flood on {target_ip} for {duration}s at {rate} pps")
+    end = time.time() + duration
+    while time.time() < end:
+        for _ in range(rate):
+            pkt = IP(dst=target_ip)/UDP(dport=random.randint(1, 65535))
+            send(pkt, verbose=False)
+        time.sleep(1)
+
+if __name__ == "__main__":
+    print("Choose attack: 1=Port Scan, 2=Brute Force, 3=DDoS Flood")
+    choice = input("> ")
+    if choice == "1":
+        port_scan()
+    elif choice == "2":
+        brute_force()
+    elif choice == "3":
+        ddos_flood()
+    else:
+        print("Invalid")