AegisAI

Identifies volumetric traffic spikes via Isolation Forest and connection anomalies. Enforces rate limits, CAPTCHA gates, and physical Null Routing before servers crash.

Deploys interactive DMZ honeypots to trap attackers. Builds deep Threat DNA profiles including the attacker's Motivation, Skill Level, Operator Type, and OPSEC Rating.

Utilizes TF-IDF and Naive Bayes to classify semantic indicators in emails, while behavioral watchers hash files to catch Trojans and auto-quarantine supply chain dependencies.

Raw network traffic and log files are ingested locally. A Python module instantly processes the raw TCP/UDP packets into a structured NumPy array containing exactly 78 distinct network features (e.g., Flow Duration, Fwd Packet Length Std, ACK Flag Count).

The structured data is fed into the loaded Isolation Forest model. The model asks: "Is this traffic mathematically abnormal compared to our baseline?" If the generated anomaly score drops below the safety threshold, the packet is flagged for deep inspection.

Flagged traffic routes to the Random Forest classifier, which determines the specific attack signature (e.g., "DDoS") and assigns a confidence percentage. Simultaneously, parallel rule engines scan for non-ML threats like SQL injections or unauthorized port scanning.

The central Orchestrator cross-references the anomaly score and classification confidence to dynamically calculate a final Severity Score (Low to Critical). Based on this score, it retrieves the precise mitigation playbook.

The system executes the playbook—physically severing malicious TCP sockets, updating the local SQLite blacklist, and broadcasting the incident via WebSockets to the frontend dashboard for instant security team visibility.

Model I: Isolation Forest (Zero-Day Detection)

Trained exclusively on 'BENIGN' traffic from the industry-standard CICIDS2017 Dataset. The Isolation Forest parses 78 distinct network flow features (like `Flow Bytes/s`, `Init_Win_bytes_forward`) to learn the exact mathematical bounds of "normal" traffic.

By detecting deviation rather than matching signatures, this model successfully flags zero-day exploits we have never seen before.

Model II: Random Forest Classifier

Once the Isolation Forest scores an anomaly below -0.1, the packet data is handed off to a 200-tree Random Forest classifier. This model categorizes the anomaly into 8 specific attack vectors with a staggering 97-99% accuracy.

The engine computes a strict severity matrix dynamically. For example, a Critical alert is fired only when confidence >= 0.9 AND anomaly_score <= -0.5.

Model III: NLP Phishing Scanner

A specialized Natural Language Processing module utilizing TF-IDF + Logistic Regression. It analyzes email text for semantic red flags (e.g., "urgent", "suspended") and evaluates URLs using regex for typosquatting or bare IPs.

It outputs highly structured JSON identifying the exact signals found and triggering automatic SMTP quarantines.