Spaces:
Runtime error
Runtime error
Upload AI deception env
Browse files- Dockerfile +11 -0
- README.md +80 -11
- env/__init__.py +0 -0
- env/__pycache__/__init__.cpython-312.pyc +0 -0
- env/__pycache__/attacker.cpython-312.pyc +0 -0
- env/__pycache__/deception.cpython-312.pyc +0 -0
- env/__pycache__/env.cpython-312.pyc +0 -0
- env/__pycache__/fake_server.cpython-312.pyc +0 -0
- env/attacker.py +25 -0
- env/deception.py +28 -0
- env/env.py +52 -0
- env/fake_server.py +50 -0
- env/test_env.py +12 -0
- env/test_server.py +3 -0
- inference.py +28 -0
- openenv.yaml +10 -0
- requirements.txt +5 -0
- tasks/__init__.py +0 -0
- tasks/__pycache__/__init__.cpython-312.pyc +0 -0
- tasks/__pycache__/easy.cpython-312.pyc +0 -0
- tasks/__pycache__/hard.cpython-312.pyc +0 -0
- tasks/__pycache__/medium.cpython-312.pyc +0 -0
- tasks/__pycache__/test_tasks.cpython-312.pyc +0 -0
- tasks/easy.py +14 -0
- tasks/hard.py +23 -0
- tasks/medium.py +11 -0
- tasks/test_tasks.py +7 -0
Dockerfile
ADDED
|
@@ -0,0 +1,11 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
FROM python:3.10-slim
|
| 2 |
+
|
| 3 |
+
WORKDIR /app
|
| 4 |
+
|
| 5 |
+
COPY . .
|
| 6 |
+
|
| 7 |
+
RUN pip install --no-cache-dir -r requirements.txt
|
| 8 |
+
|
| 9 |
+
EXPOSE 5000
|
| 10 |
+
|
| 11 |
+
CMD ["python", "inference.py"]
|
README.md
CHANGED
|
@@ -1,11 +1,80 @@
|
|
| 1 |
-
|
| 2 |
-
|
| 3 |
-
|
| 4 |
-
|
| 5 |
-
|
| 6 |
-
|
| 7 |
-
|
| 8 |
-
|
| 9 |
-
-
|
| 10 |
-
|
| 11 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
# AI Cyber Deception OpenEnv
|
| 2 |
+
|
| 3 |
+
## Overview
|
| 4 |
+
|
| 5 |
+
AI Cyber Deception OpenEnv is a real-world cybersecurity simulation environment where an AI agent learns to detect attackers and deploy deception strategies such as honeypots.
|
| 6 |
+
|
| 7 |
+
## Features
|
| 8 |
+
|
| 9 |
+
- Fake server simulation
|
| 10 |
+
- Attacker simulation
|
| 11 |
+
- AI deception environment
|
| 12 |
+
- Reward-based learning
|
| 13 |
+
- Multiple difficulty tasks
|
| 14 |
+
|
| 15 |
+
## Tasks
|
| 16 |
+
|
| 17 |
+
### Easy
|
| 18 |
+
Detect brute force attack
|
| 19 |
+
|
| 20 |
+
### Medium
|
| 21 |
+
Deploy honeypot
|
| 22 |
+
|
| 23 |
+
### Hard
|
| 24 |
+
Full incident response (detect, deceive, block)
|
| 25 |
+
|
| 26 |
+
## Actions
|
| 27 |
+
|
| 28 |
+
- detect_attack
|
| 29 |
+
- deploy_honeypot
|
| 30 |
+
- block_ip
|
| 31 |
+
|
| 32 |
+
## Reward System
|
| 33 |
+
|
| 34 |
+
- Detect attack → +0.5
|
| 35 |
+
- Deploy honeypot → +0.3
|
| 36 |
+
- Block attacker → +0.2
|
| 37 |
+
|
| 38 |
+
## Project Structure
|
| 39 |
+
ai_deception_env/
|
| 40 |
+
├── env/
|
| 41 |
+
├── tasks/
|
| 42 |
+
├── inference.py
|
| 43 |
+
├── openenv.yaml
|
| 44 |
+
├── Dockerfile
|
| 45 |
+
|
| 46 |
+
|
| 47 |
+
## Run
|
| 48 |
+
|
| 49 |
+
### Local
|
| 50 |
+
|
| 51 |
+
|
| 52 |
+
python inference.py
|
| 53 |
+
|
| 54 |
+
|
| 55 |
+
### Docker
|
| 56 |
+
|
| 57 |
+
|
| 58 |
+
docker build -t ai-deception-env .
|
| 59 |
+
docker run ai-deception-env
|
| 60 |
+
|
| 61 |
+
|
| 62 |
+
## Example Output
|
| 63 |
+
|
| 64 |
+
|
| 65 |
+
[START]
|
| 66 |
+
[STEP]
|
| 67 |
+
[STEP]
|
| 68 |
+
[STEP]
|
| 69 |
+
[END]
|
| 70 |
+
|
| 71 |
+
|
| 72 |
+
## Requirements
|
| 73 |
+
|
| 74 |
+
- Python 3.10
|
| 75 |
+
- Flask
|
| 76 |
+
- Requests
|
| 77 |
+
|
| 78 |
+
## Author
|
| 79 |
+
|
| 80 |
+
Bytecore team
|
env/__init__.py
ADDED
|
File without changes
|
env/__pycache__/__init__.cpython-312.pyc
ADDED
|
Binary file (191 Bytes). View file
|
|
|
env/__pycache__/attacker.cpython-312.pyc
ADDED
|
Binary file (921 Bytes). View file
|
|
|
env/__pycache__/deception.cpython-312.pyc
ADDED
|
Binary file (838 Bytes). View file
|
|
|
env/__pycache__/env.cpython-312.pyc
ADDED
|
Binary file (1.91 kB). View file
|
|
|
env/__pycache__/fake_server.cpython-312.pyc
ADDED
|
Binary file (1.98 kB). View file
|
|
|
env/attacker.py
ADDED
|
@@ -0,0 +1,25 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
import requests
|
| 2 |
+
import time
|
| 3 |
+
|
| 4 |
+
TARGET = "http://127.0.0.1:5000"
|
| 5 |
+
|
| 6 |
+
def brute_force():
|
| 7 |
+
|
| 8 |
+
print("Starting brute force attack...")
|
| 9 |
+
|
| 10 |
+
for i in range(5):
|
| 11 |
+
response = requests.post(
|
| 12 |
+
f"{TARGET}/login",
|
| 13 |
+
data={
|
| 14 |
+
"username": "admin",
|
| 15 |
+
"password": "wrong"
|
| 16 |
+
}
|
| 17 |
+
)
|
| 18 |
+
|
| 19 |
+
print("Attempt:", i+1, response.json())
|
| 20 |
+
|
| 21 |
+
time.sleep(1)
|
| 22 |
+
|
| 23 |
+
|
| 24 |
+
if __name__ == "__main__":
|
| 25 |
+
brute_force()
|
env/deception.py
ADDED
|
@@ -0,0 +1,28 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
def deploy_honeypot():
|
| 2 |
+
|
| 3 |
+
print("Honeypot deployed")
|
| 4 |
+
|
| 5 |
+
return {
|
| 6 |
+
"action": "honeypot",
|
| 7 |
+
"status": "deployed"
|
| 8 |
+
}
|
| 9 |
+
|
| 10 |
+
|
| 11 |
+
def fake_database():
|
| 12 |
+
|
| 13 |
+
print("Fake database exposed")
|
| 14 |
+
|
| 15 |
+
return {
|
| 16 |
+
"action": "fake_db",
|
| 17 |
+
"status": "active"
|
| 18 |
+
}
|
| 19 |
+
|
| 20 |
+
|
| 21 |
+
def block_attacker(ip):
|
| 22 |
+
|
| 23 |
+
print(f"Blocked attacker: {ip}")
|
| 24 |
+
|
| 25 |
+
return {
|
| 26 |
+
"action": "block",
|
| 27 |
+
"ip": ip
|
| 28 |
+
}
|
env/env.py
ADDED
|
@@ -0,0 +1,52 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
import requests
|
| 2 |
+
from env.deception import deploy_honeypot, fake_database, block_attacker
|
| 3 |
+
|
| 4 |
+
SERVER = "http://127.0.0.1:5000"
|
| 5 |
+
|
| 6 |
+
class DeceptionEnv:
|
| 7 |
+
|
| 8 |
+
def __init__(self):
|
| 9 |
+
self.state = {}
|
| 10 |
+
self.done = False
|
| 11 |
+
|
| 12 |
+
def reset(self):
|
| 13 |
+
|
| 14 |
+
self.done = False
|
| 15 |
+
|
| 16 |
+
logs = requests.get(f"{SERVER}/logs").json()
|
| 17 |
+
|
| 18 |
+
self.state = logs
|
| 19 |
+
|
| 20 |
+
return self.state
|
| 21 |
+
|
| 22 |
+
|
| 23 |
+
def step(self, action):
|
| 24 |
+
|
| 25 |
+
reward = 0
|
| 26 |
+
|
| 27 |
+
logs = requests.get(f"{SERVER}/logs").json()
|
| 28 |
+
|
| 29 |
+
failed_logins = logs["failed_logins"]
|
| 30 |
+
|
| 31 |
+
if action == "detect_attack":
|
| 32 |
+
if failed_logins > 3:
|
| 33 |
+
reward += 0.5
|
| 34 |
+
|
| 35 |
+
if action == "deploy_honeypot":
|
| 36 |
+
deploy_honeypot()
|
| 37 |
+
reward += 0.3
|
| 38 |
+
|
| 39 |
+
if action == "fake_database":
|
| 40 |
+
fake_database()
|
| 41 |
+
reward += 0.2
|
| 42 |
+
|
| 43 |
+
if action == "block_ip":
|
| 44 |
+
if logs["suspicious_ips"]:
|
| 45 |
+
ip = logs["suspicious_ips"][0]
|
| 46 |
+
block_attacker(ip)
|
| 47 |
+
reward += 0.2
|
| 48 |
+
self.done = True
|
| 49 |
+
|
| 50 |
+
self.state = logs
|
| 51 |
+
|
| 52 |
+
return self.state, reward, self.done, {}
|
env/fake_server.py
ADDED
|
@@ -0,0 +1,50 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
from flask import Flask, request, jsonify
|
| 2 |
+
import time
|
| 3 |
+
|
| 4 |
+
app = Flask(__name__)
|
| 5 |
+
|
| 6 |
+
# Global logs
|
| 7 |
+
logs = {
|
| 8 |
+
"failed_logins": 0,
|
| 9 |
+
"suspicious_ips": [],
|
| 10 |
+
"requests": []
|
| 11 |
+
}
|
| 12 |
+
|
| 13 |
+
|
| 14 |
+
@app.route("/login", methods=["POST"])
|
| 15 |
+
def login():
|
| 16 |
+
|
| 17 |
+
ip = request.remote_addr
|
| 18 |
+
username = request.form.get("username")
|
| 19 |
+
password = request.form.get("password")
|
| 20 |
+
|
| 21 |
+
logs["requests"].append({
|
| 22 |
+
"ip": ip,
|
| 23 |
+
"username": username,
|
| 24 |
+
"time": time.time()
|
| 25 |
+
})
|
| 26 |
+
|
| 27 |
+
# Fake login check
|
| 28 |
+
if password == "admin123":
|
| 29 |
+
return jsonify({"status": "success"})
|
| 30 |
+
|
| 31 |
+
else:
|
| 32 |
+
logs["failed_logins"] += 1
|
| 33 |
+
|
| 34 |
+
if ip not in logs["suspicious_ips"]:
|
| 35 |
+
logs["suspicious_ips"].append(ip)
|
| 36 |
+
|
| 37 |
+
return jsonify({"status": "failed"})
|
| 38 |
+
|
| 39 |
+
|
| 40 |
+
@app.route("/logs", methods=["GET"])
|
| 41 |
+
def get_logs():
|
| 42 |
+
return jsonify(logs)
|
| 43 |
+
|
| 44 |
+
|
| 45 |
+
def run_server():
|
| 46 |
+
app.run(port=5000)
|
| 47 |
+
|
| 48 |
+
@app.route("/")
|
| 49 |
+
def home():
|
| 50 |
+
return "AI Cyber Deception Server Running"
|
env/test_env.py
ADDED
|
@@ -0,0 +1,12 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
from env import DeceptionEnv
|
| 2 |
+
|
| 3 |
+
env = DeceptionEnv()
|
| 4 |
+
|
| 5 |
+
state = env.reset()
|
| 6 |
+
|
| 7 |
+
print("Initial State:", state)
|
| 8 |
+
|
| 9 |
+
state, reward, done, _ = env.step("deploy_honeypot")
|
| 10 |
+
|
| 11 |
+
print("After step:", state)
|
| 12 |
+
print("Reward:", reward)
|
env/test_server.py
ADDED
|
@@ -0,0 +1,3 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
from fake_server import run_server
|
| 2 |
+
|
| 3 |
+
run_server()
|
inference.py
ADDED
|
@@ -0,0 +1,28 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
import threading
|
| 2 |
+
import time
|
| 3 |
+
|
| 4 |
+
from env.fake_server import run_server
|
| 5 |
+
from tasks.easy import run as easy
|
| 6 |
+
from tasks.medium import run as medium
|
| 7 |
+
from tasks.hard import run as hard
|
| 8 |
+
|
| 9 |
+
|
| 10 |
+
# Start fake server in background
|
| 11 |
+
server_thread = threading.Thread(target=run_server, daemon=True)
|
| 12 |
+
server_thread.start()
|
| 13 |
+
|
| 14 |
+
time.sleep(2) # wait for server to start
|
| 15 |
+
|
| 16 |
+
|
| 17 |
+
print("[START] task=ai-deception env=cyber-security model=baseline")
|
| 18 |
+
|
| 19 |
+
easy_score = easy()
|
| 20 |
+
print(f"[STEP] step=1 action=easy reward={easy_score:.2f} done=false error=null")
|
| 21 |
+
|
| 22 |
+
medium_score = medium()
|
| 23 |
+
print(f"[STEP] step=2 action=medium reward={medium_score:.2f} done=false error=null")
|
| 24 |
+
|
| 25 |
+
hard_score = hard()
|
| 26 |
+
print(f"[STEP] step=3 action=hard reward={hard_score:.2f} done=true error=null")
|
| 27 |
+
|
| 28 |
+
print(f"[END] success=true steps=3 rewards={easy_score:.2f},{medium_score:.2f},{hard_score:.2f}")
|
openenv.yaml
ADDED
|
@@ -0,0 +1,10 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
name: ai-deception-env
|
| 2 |
+
description: AI Cyber Deception Environment
|
| 3 |
+
version: 1.0
|
| 4 |
+
|
| 5 |
+
tasks:
|
| 6 |
+
- easy
|
| 7 |
+
- medium
|
| 8 |
+
- hard
|
| 9 |
+
|
| 10 |
+
entry_point: inference.py
|
requirements.txt
ADDED
|
@@ -0,0 +1,5 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
flask
|
| 2 |
+
requests
|
| 3 |
+
numpy
|
| 4 |
+
pydantic
|
| 5 |
+
openai
|
tasks/__init__.py
ADDED
|
File without changes
|
tasks/__pycache__/__init__.cpython-312.pyc
ADDED
|
Binary file (193 Bytes). View file
|
|
|
tasks/__pycache__/easy.cpython-312.pyc
ADDED
|
Binary file (613 Bytes). View file
|
|
|
tasks/__pycache__/hard.cpython-312.pyc
ADDED
|
Binary file (842 Bytes). View file
|
|
|
tasks/__pycache__/medium.cpython-312.pyc
ADDED
|
Binary file (539 Bytes). View file
|
|
|
tasks/__pycache__/test_tasks.cpython-312.pyc
ADDED
|
Binary file (462 Bytes). View file
|
|
|
tasks/easy.py
ADDED
|
@@ -0,0 +1,14 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
from env.env import DeceptionEnv
|
| 2 |
+
from env.attacker import brute_force
|
| 3 |
+
|
| 4 |
+
def run():
|
| 5 |
+
|
| 6 |
+
brute_force()
|
| 7 |
+
|
| 8 |
+
env = DeceptionEnv()
|
| 9 |
+
|
| 10 |
+
env.reset()
|
| 11 |
+
|
| 12 |
+
state, reward, done, _ = env.step("detect_attack")
|
| 13 |
+
|
| 14 |
+
return reward
|
tasks/hard.py
ADDED
|
@@ -0,0 +1,23 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
from env.env import DeceptionEnv
|
| 2 |
+
from env.attacker import brute_force
|
| 3 |
+
|
| 4 |
+
def run():
|
| 5 |
+
|
| 6 |
+
brute_force()
|
| 7 |
+
|
| 8 |
+
env = DeceptionEnv()
|
| 9 |
+
|
| 10 |
+
env.reset()
|
| 11 |
+
|
| 12 |
+
total_reward = 0
|
| 13 |
+
|
| 14 |
+
_, r, _, _ = env.step("detect_attack")
|
| 15 |
+
total_reward += r
|
| 16 |
+
|
| 17 |
+
_, r, _, _ = env.step("deploy_honeypot")
|
| 18 |
+
total_reward += r
|
| 19 |
+
|
| 20 |
+
_, r, _, _ = env.step("block_ip")
|
| 21 |
+
total_reward += r
|
| 22 |
+
|
| 23 |
+
return total_reward
|
tasks/medium.py
ADDED
|
@@ -0,0 +1,11 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
from env.env import DeceptionEnv
|
| 2 |
+
|
| 3 |
+
def run():
|
| 4 |
+
|
| 5 |
+
env = DeceptionEnv()
|
| 6 |
+
|
| 7 |
+
env.reset()
|
| 8 |
+
|
| 9 |
+
state, reward, done, _ = env.step("deploy_honeypot")
|
| 10 |
+
|
| 11 |
+
return reward
|
tasks/test_tasks.py
ADDED
|
@@ -0,0 +1,7 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
from tasks.easy import run as easy
|
| 2 |
+
from tasks.medium import run as medium
|
| 3 |
+
from tasks.hard import run as hard
|
| 4 |
+
|
| 5 |
+
print("Easy:", easy())
|
| 6 |
+
print("Medium:", medium())
|
| 7 |
+
print("Hard:", hard())
|