An AI-Driven Cyber Defense Platform combining Network Flow Machine Learning, Behavioral Biometrics, and Real-Time Threat Intelligence for autonomous intrusion detection.
A unified AI/ML cyber-defense system that detects DDoS attacks and automated bots using a dual pipeline of network-flow machine learning (RF + XGBoost) and mouse-dynamics behavioral biometrics (RF + LSTM). It features a secure Flask backend with JWT auth, real-time Socket.IO alerts, and MySQL logging, delivering a low-latency, multi-modal defense layer against modern network threats and automated attacks.
Flow-Based Intrusion Detection using Random Forest + XGBoost ensemble.
Behavioral Biometrics (Mouse Dynamics) with RF + LSTM hybrid modeling.
Real-Time Threat Alerts via Socket.IO dashboard.
Adaptive Rate Limiting & IP Blocking using sliding-window analysis.
Automation Detection for Selenium, Puppeteer, and Playwright bots.
Secure Backend Architecture with Flask, JWT auth, and bcrypt hashing.
MySQL Data Persistence for flows, behavioral events, and predictions.
Modular, Low-Latency Pipeline optimized for real-time cyber defense.
| Model | Purpose | File |
|---|---|---|
| Random Forest | Baseline binary classifier | rf_model.save |
| XGBoost | Final booster model | xgb_model.json |
| Scaler | Feature normalization | scaler_used.save |
| Label Encoder | Attack label encoding | label_encoder.save |
| Model | Purpose | File |
|---|---|---|
| RF Classifier | Handcrafted feature classifier | mouse_rf.save |
| LSTM Model | Temporal sequence model | mouse_lstm.keras |
| Scaler | LSTM normalization | mouse_lstm_scaler.save |
| Ensemble Meta | Hybrid weighting | mouse_ensemble_meta.json |
Balabit Mouse Dynamics Dataset
git clone https://github.com/Spyderzz/AIML-CyberDefense-System
cd AIML-CyberDefense-System
Download pre-trained models and place them in ./data/processed or run bash:
curl -L -o data_processed.zip "https://github.com/<username>/<repo>/releases/download/v1.0-models/data_processed.zip"
unzip data_processed.zip -d data/processedcd backend
python -m venv venv
venv/Scripts/activate # Windows
pip install -r requirements.txtcd frontend
npm install
npm run devCreate .env using this powershell cmd:
Copy-Item .env.example -Destination .env"homepage": "https://<your-username>.github.io/<repo-name>"npm install --save-dev gh-pages"scripts": {
"build": "vite build",
"predeploy": "npm run build",
"deploy": "gh-pages -d dist"
}npm run deploydocker build -t aiml-cyberdefense-system .docker run -p 5000:5000 aiml-cyberdefense-system- Behavior-driven bot detection
- Adaptive sliding-window IP rate limiting
- Auto-blocking suspicious clients
- Automation fingerprint detection
- JWT access/refresh tokens
- BCrypt hashing with cost upgrade
MIT License — free for academic, research, and commercial use.
Atharva
