Strong-hold

App that detects port-scans and flood attackes

Technologies and options:

First make sure you have python3
Make sure you have installed mysql, Bestway to do it is using docker, use docker pull mysql:8
clone this project with git clone https://github.com/arshia2012/Strong-hold or just download it here and extract it
Change Directory to project folder
Install the requirements.txt file pip install -r requirement.txt
Go to .env.example file, fill the DB_PASS with whatever you like, remember it and then change the file from .env.example to .env
Then run mysql docker run -d --name mysql-stronghold -e MYSQL_ROOT_PASSWORD=Your_password_here -p 3306:3306 mysql:8, remember to write your password exactly what you write in .env
Don't turn mysql off (Keyboard interrupt), when you are using it or doing the setup
Run python3 config.py then python3 setup_db.py And after that python3 db_connector.py
For test, run python3 event_logger.py and python3 stats_logger.py too
Run python3 argus.py and wait for at least 1 hour, in this 1 hour, turn all things on and Attack the ip address argus is running on with port scan and flood and Make sure, thats your ip, This project is for legal usage only
Then, after at least one hour, you can turn the arugus off by ctl+c and Run python3 train_model.py
After it finished it's work, Stronghold is ready for work, Run python3 argus.py first and for Webapp monitoring, run python3 app.py
After you turned the Webapp on, go to http://localhost:5000 and here you can see data that argus get in web

Webapp View:

This is an Educational app, so There are false positives in The project
Before taking action to the attacker ip, make sure it isn't a false posetive
You can make sure By giving the ip to AI and ask if this ip is for a company (Most false positives are because google or Microsoft IP)
Use this App for Educational and Legal use only