Spaces:
Runtime error
Runtime error
fix startup order
Browse files- README.md +69 -43
- models.py +14 -0
- openenv.yaml +22 -5
README.md
CHANGED
|
@@ -11,79 +11,105 @@ pinned: false
|
|
| 11 |
|
| 12 |
## Overview
|
| 13 |
|
| 14 |
-
|
| 15 |
|
| 16 |
-
|
| 17 |
|
| 18 |
-
-
|
| 19 |
-
- Attacker simulation
|
| 20 |
-
- AI deception environment
|
| 21 |
-
- Reward-based learning
|
| 22 |
-
- Multiple difficulty tasks
|
| 23 |
|
| 24 |
-
##
|
| 25 |
|
| 26 |
-
|
| 27 |
-
Detect brute force attack
|
| 28 |
|
| 29 |
-
|
| 30 |
-
|
|
|
|
|
|
|
| 31 |
|
| 32 |
-
|
| 33 |
-
Full incident response (detect, deceive, block)
|
| 34 |
|
| 35 |
-
##
|
|
|
|
|
|
|
| 36 |
|
| 37 |
- detect_attack
|
| 38 |
- deploy_honeypot
|
|
|
|
| 39 |
- block_ip
|
| 40 |
|
| 41 |
-
|
| 42 |
|
| 43 |
-
|
| 44 |
-
- Deploy honeypot → +0.3
|
| 45 |
-
- Block attacker → +0.2
|
| 46 |
|
| 47 |
-
|
| 48 |
-
ai_deception_env/
|
| 49 |
-
├── env/
|
| 50 |
-
├── tasks/
|
| 51 |
-
├── inference.py
|
| 52 |
-
├── openenv.yaml
|
| 53 |
-
├── Dockerfile
|
| 54 |
|
|
|
|
|
|
|
|
|
|
|
|
|
| 55 |
|
| 56 |
-
|
| 57 |
|
| 58 |
-
##
|
| 59 |
|
|
|
|
|
|
|
| 60 |
|
| 61 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 62 |
|
|
|
|
| 63 |
|
| 64 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
| 65 |
|
|
|
|
|
|
|
|
|
|
| 66 |
|
| 67 |
-
|
| 68 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 69 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 70 |
|
| 71 |
-
|
|
|
|
|
|
|
| 72 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 73 |
|
| 74 |
[START]
|
| 75 |
[STEP]
|
| 76 |
[STEP]
|
| 77 |
[STEP]
|
| 78 |
[END]
|
|
|
|
| 79 |
|
| 80 |
-
|
| 81 |
-
## Requirements
|
| 82 |
-
|
| 83 |
-
- Python 3.10
|
| 84 |
-
- Flask
|
| 85 |
-
- Requests
|
| 86 |
-
|
| 87 |
-
## Author
|
| 88 |
-
|
| 89 |
-
Bytecore team
|
|
|
|
| 11 |
|
| 12 |
## Overview
|
| 13 |
|
| 14 |
+
This project implements a real-world AI Cyber Deception environment where an AI agent learns to detect and mitigate cyber attacks such as brute force, port scanning, and credential stuffing.
|
| 15 |
|
| 16 |
+
The environment follows the OpenEnv specification and supports step(), reset(), and state() APIs.
|
| 17 |
|
| 18 |
+
---
|
|
|
|
|
|
|
|
|
|
|
|
|
| 19 |
|
| 20 |
+
## Real-world Task
|
| 21 |
|
| 22 |
+
Simulate cybersecurity defense in a production-like environment:
|
|
|
|
| 23 |
|
| 24 |
+
- Detect brute force attacks
|
| 25 |
+
- Detect port scanning
|
| 26 |
+
- Deploy deception mechanisms
|
| 27 |
+
- Block malicious IPs
|
| 28 |
|
| 29 |
+
---
|
|
|
|
| 30 |
|
| 31 |
+
## Action Space
|
| 32 |
+
|
| 33 |
+
The agent can perform:
|
| 34 |
|
| 35 |
- detect_attack
|
| 36 |
- deploy_honeypot
|
| 37 |
+
- fake_database
|
| 38 |
- block_ip
|
| 39 |
|
| 40 |
+
---
|
| 41 |
|
| 42 |
+
## Observation Space
|
|
|
|
|
|
|
| 43 |
|
| 44 |
+
Environment returns:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 45 |
|
| 46 |
+
- failed_logins
|
| 47 |
+
- port_scans
|
| 48 |
+
- suspicious_ips
|
| 49 |
+
- request logs
|
| 50 |
|
| 51 |
+
---
|
| 52 |
|
| 53 |
+
## Tasks
|
| 54 |
|
| 55 |
+
### Easy Task
|
| 56 |
+
Detect brute force attack
|
| 57 |
|
| 58 |
+
### Medium Task
|
| 59 |
+
Deploy honeypot after detecting attack
|
| 60 |
+
|
| 61 |
+
### Hard Task
|
| 62 |
+
Block malicious attacker
|
| 63 |
+
|
| 64 |
+
---
|
| 65 |
|
| 66 |
+
## Reward Function
|
| 67 |
|
| 68 |
+
| Action | Reward |
|
| 69 |
+
|--------|--------|
|
| 70 |
+
| detect_attack | 0.4 |
|
| 71 |
+
| deploy_honeypot | 0.2 |
|
| 72 |
+
| block_ip | 0.3 |
|
| 73 |
|
| 74 |
+
---
|
| 75 |
+
|
| 76 |
+
## APIs
|
| 77 |
|
| 78 |
+
- `/reset`
|
| 79 |
+
- `/step`
|
| 80 |
+
- `/state`
|
| 81 |
+
- `/logs`
|
| 82 |
+
- `/status`
|
| 83 |
+
|
| 84 |
+
---
|
| 85 |
|
| 86 |
+
## Setup
|
| 87 |
+
|
| 88 |
+
### Run locally
|
| 89 |
+
|
| 90 |
+
```bash
|
| 91 |
+
pip install -r requirements.txt
|
| 92 |
+
python inference.py
|
| 93 |
|
| 94 |
+
Docker
|
| 95 |
+
docker build -t ai-deception .
|
| 96 |
+
docker run ai-deception
|
| 97 |
|
| 98 |
+
Hugging Face Deployment
|
| 99 |
+
https://bytecore1-ai-deception-openenv.hf.space/
|
| 100 |
+
https://bytecore1-ai-deception-openenv.hf.space/state
|
| 101 |
+
https://bytecore1-ai-deception-openenv.hf.space/status
|
| 102 |
+
https://bytecore1-ai-deception-openenv.hf.space/logs
|
| 103 |
+
|
| 104 |
+
Baseline Results
|
| 105 |
+
|
| 106 |
+
Example:
|
| 107 |
|
| 108 |
[START]
|
| 109 |
[STEP]
|
| 110 |
[STEP]
|
| 111 |
[STEP]
|
| 112 |
[END]
|
| 113 |
+
Architecture
|
| 114 |
|
| 115 |
+
Attacker → Fake Server → AI Agent → Defense Actions → Reward
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
models.py
ADDED
|
@@ -0,0 +1,14 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
from pydantic import BaseModel
|
| 2 |
+
from typing import List
|
| 3 |
+
|
| 4 |
+
class Observation(BaseModel):
|
| 5 |
+
failed_logins: int
|
| 6 |
+
port_scans: int
|
| 7 |
+
suspicious_ips: List[str]
|
| 8 |
+
|
| 9 |
+
class Action(BaseModel):
|
| 10 |
+
action: str
|
| 11 |
+
|
| 12 |
+
class Reward(BaseModel):
|
| 13 |
+
reward: float
|
| 14 |
+
done: bool
|
openenv.yaml
CHANGED
|
@@ -1,10 +1,27 @@
|
|
| 1 |
name: ai-deception-env
|
| 2 |
description: AI Cyber Deception Environment
|
| 3 |
-
version: 1.0
|
| 4 |
|
| 5 |
tasks:
|
| 6 |
-
- easy
|
| 7 |
-
|
| 8 |
-
- hard
|
| 9 |
|
| 10 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
name: ai-deception-env
|
| 2 |
description: AI Cyber Deception Environment
|
|
|
|
| 3 |
|
| 4 |
tasks:
|
| 5 |
+
- name: easy
|
| 6 |
+
description: Detect brute force attack
|
|
|
|
| 7 |
|
| 8 |
+
- name: medium
|
| 9 |
+
description: Deploy honeypot
|
| 10 |
+
|
| 11 |
+
- name: hard
|
| 12 |
+
description: Block attacker
|
| 13 |
+
|
| 14 |
+
entrypoint: inference.py
|
| 15 |
+
|
| 16 |
+
actions:
|
| 17 |
+
- detect_attack
|
| 18 |
+
- deploy_honeypot
|
| 19 |
+
- fake_database
|
| 20 |
+
- block_ip
|
| 21 |
+
|
| 22 |
+
observations:
|
| 23 |
+
- failed_logins
|
| 24 |
+
- port_scans
|
| 25 |
+
- suspicious_ips
|
| 26 |
+
|
| 27 |
+
reward_range: [0.0, 1.0]
|