Cybertection Cybernetic Guardian Ai (for Windows and Linux)

Program Description: Cybertection Guardian

Cybertection Guardian is a Python-based desktop security application designed to provide real-time monitoring and basic threat detection for your computer. It acts as a local guardian, observing network activity, system processes, and filesystem changes to identify potentially malicious behavior, with a particular focus on detecting signs of DDoS attacks and ransomware activity.

Core Features:

• Real-Time Network Monitoring: Continuously scans active network connections, flagging connections to suspicious ports, known blacklisted IPs, or those initiated by processes often associated with malware.
• DDoS Protection Shield: Monitors the number of active network connections and alerts if this number exceeds a user-defined threshold, which could indicate a Distributed Denial of Service (DDoS) attack. 1  

  1. How to use the netstat command in Linux - Hostinger

  www.hostinger.com

• Ransomware Protection:
  • Process Scanning: Periodically scans running processes, comparing them against a database of known ransomware file hashes and looking for suspicious keywords in process names or command lines. It can be configured to automatically terminate suspicious processes or prompt the user for action.
  • Filesystem Monitoring: Actively watches user-specified directories (e.g., Documents, Desktop) for unusually rapid file modification activity, a common indicator of ransomware encrypting files.
• Cybertection AI Analyst: An integrated AI-powered assistant that processes detected alerts to provide contextual insights. Users can query the AI for summaries of critical threats, frequently alerted IPs or processes, and more.
• Consolidated Alerting & Threat Scoring: All suspicious activities are logged, displayed in a central alert panel, and contribute to an overall "Threat Level" score, giving a visual indication of current system risk.
• User-Friendly Interface: Built with PyQt5, it offers a graphical interface to view live network data, see security alerts, toggle protection modules, and configure settings.
• Customizable Settings: Most operational parameters, such as scan intervals, alert thresholds, monitored paths, and AI behavior, can be customized through a settings dialog and are saved locally.
• Detailed Logging: Maintains a persistent log file of all alerts and significant system events for later review and analysis.

Cybertection Guardian aims to provide an additional layer of security awareness and early warning, empowering users to take quicker action against potential threats on their local machine.

Disclaimer: Cybertection Guardian is a tool developed from the provided script and should be seen as a supplementary security utility. It is not a replacement for comprehensive, commercially available antivirus software, firewalls, or other professional security solutions.

Understanding the Main Interface:

• Top Header Area:
  • Title: The application name.
  • System Status: Shows the current operational status (e.g., "ACTIVE MONITORING," "SCANNING NETWORK").
  • Threat Level Bar: A progress bar indicating the cumulative score of detected threats.
  • AI Insight Label: Displays periodic insights from the Cybertection AI Analyst.
  • Emergency Stop Button: Allows you to quickly disable all active protection modules.
• Left Panel:
  • Fetch PID Info: Enter a Process ID (PID) and click "Get Info" to see details about that process.
  • Real-Time Network Activity: Displays a live feed of network connections and their details.
• Right Panel:
  • Protection Modules:
    • DDoS Shield: Toggle button and status label.
    • Ransomware Process Scan: Toggle button and status label.
    • Ransomware FS Monitor: Toggle button and status label.
  • Consolidated Security Alerts: Shows a running log of all detected alerts and suspicious activities.
• Bottom Control Buttons:
  • FORCE SCAN ALL: Manually triggers all active scanning tasks.
  • Ask Cybertection AI: Opens a dialog to query the AI analyst.
  • Open Log File: Opens the persistent cyber_guardian_alerts.log file.
  • Clear GUI Alerts: Clears the alerts displayed in the "Consolidated Security Alerts" panel (does not delete the log file).
  • SETTINGS: Opens the configuration dialog.
  • EXIT SYSTEM: Closes the application.

 Using Protection Modules:

• Enable/Disable: Click the toggle buttons (e.g., "Enable DDoS Shield") in the "Protection Modules" section. The button text and status label will update.
  • DDoS Shield: When enabled, monitors for an excessive number of network connections.
  • Ransomware Process Scan: When enabled, periodically scans running processes for known ransomware signatures and keywords.
  • Ransomware FS Monitor: When enabled, monitors the specified filesystem paths for rapid file changes.
• When a module is enabled, it will perform its checks at intervals defined in the settings.

Monitoring Activity and Alerts:

• Keep an eye on the "Real-Time Network Activity" panel for connection details.
• The "Consolidated Security Alerts" panel will display any threats detected by the active modules.
• The "Threat Level" bar will increase as alerts accumulate.
• If the "Ransomware Process Scan" detects a threat and is not set to "Auto-kill," a dialog box will appear asking if you want to terminate the suspicious process.

Interacting with the Cybertection AI Analyst:

• Click the "Ask Cybertection AI" button.
• A dialog will appear where you can select pre-defined queries (e.g., "Summarize Critical Alerts," "Top 5 Alerted IPs") or provide parameters for specific queries (like information on a particular IP or process name).
• The AI's response will be based on the alerts it has processed during the current session.

Configuring Settings:

• Click the "SETTINGS" button.
• General: Application title, main network scan interval.
• Cybertection AI: Enable/disable AI, AI alert memory size, insight update interval.
• DDoS Protection: Enable on startup, connection threshold, scan interval.
• Ransomware Protection:
  • Enable Process Scan/Filesystem Monitor on startup.
  • Auto-kill Suspicious Processes: Check this to have the program automatically try to terminate processes flagged by the ransomware scan. If unchecked, it will prompt you.
  • Process scan interval.
  • Monitored Paths (Filesystem): Crucially, use "Add Path" to include directories you want the Filesystem Monitor to protect (e.g., your Documents, Pictures, Desktop folders). Select paths and use "Remove Selected Path(s)" to manage them.
• Click "Save" to apply changes. Some changes might require a module to be toggled off and on, or an application restart.

Managing Logs:

• Open Log File: Click this to view the full, persistent cyber_guardian_alerts.log file in your default text editor. This log contains all alerts, even if you clear the GUI display.
• Clear GUI Alerts: Clears the on-screen alert display in the application for the current session. The cyber_guardian_alerts.log file remains untouched.

Emergency Stop:

• If you suspect a false positive storm or want to quickly halt all protection activities, click the "EMERGENCY STOP" button. This will toggle off all active protection modules.

Important Tips:

• Review Alerts: Pay attention to the alerts. While the tool aims to be accurate, investigate before taking drastic actions if you're unsure.
• Customize Monitored Paths: The Ransomware Filesystem Monitor is only effective if you tell it which important folders to watch.
• Log File Location: By default, cyber_guardian_settings.json, cyber_guardian_alerts.log, and ransomware_signatures.json are created in the same directory where you run the Python script.
• Regularly Review: Periodically check the main log file for any patterns or missed alerts.
• Update Signatures (Manual): The ransomware_signatures.json file contains example hashes. For better protection, this would ideally be updated regularly with new, known ransomware hashes from reputable sources (this process is manual for this script).