fix round 1

env/attacker.py

@@ -33,7 +33,23 @@ def credential_stuffing():
         )
 
 
+# ---------------- SQL Injection ----------------
+
+def sql_injection():
+    requests.get(f"{TARGET}/sql")
+
+
+# ---------------- Directory Traversal ----------------
+
+def directory_traversal():
+    requests.get(f"{TARGET}/download")
+
+
+# ---------------- Full Attack Simulation ----------------
+
 def simulate_attack():
     brute_force()
     port_scan()
     credential_stuffing()
+    sql_injection()
+    directory_traversal()

env/env.py

@@ -6,31 +6,37 @@ SERVER = "http://127.0.0.1:7860"
 
 class DeceptionEnv:
 
-    def _init_(self):
-        self.state = {}
+    def __init__(self):
+        self._state = {}
         self.done = False
+        self.max_steps = 5
+        self.current_step = 0
 
     def reset(self):
         self.done = False
+        self.current_step = 0
+
         logs = requests.get(f"{SERVER}/logs").json()
-        self.state = logs
-        return self.state
+        self._state = logs
+
+        return self._state
 
     def step(self, action):
 
-        reward = 0
+        reward = 0.0
+        self.current_step += 1
 
         logs = requests.get(f"{SERVER}/logs").json()
 
-        failed_logins = logs["failed_logins"]
-        requests_log = logs["requests"]
+        failed_logins = logs.get("failed_logins", 0)
+        requests_log = logs.get("requests", [])
 
         # Detect brute force
         if action == "detect_attack":
             if failed_logins > 3:
                 reward += 0.2
             else:
-                reward -= 0.1
+                reward -= 0.05
 
         # Detect port scan
         if action == "detect_attack":
@@ -40,29 +46,33 @@ class DeceptionEnv:
                     break
 
         # Deploy honeypot
-        if action == "deploy_honeypot":
+        elif action == "deploy_honeypot":
             deploy_honeypot()
             reward += 0.3
 
         # Fake database
-        if action == "fake_database":
+        elif action == "fake_database":
             fake_database()
             reward += 0.2
 
         # Block attacker
-        if action == "block_ip":
-            if logs["suspicious_ips"]:
+        elif action == "block_ip":
+            if logs.get("suspicious_ips"):
                 ip = logs["suspicious_ips"][0]
                 block_attacker(ip)
                 reward += 0.5
                 self.done = True
 
-        self.state = logs
+        # Episode boundary
+        if self.current_step >= self.max_steps:
+            self.done = True
+
+        self._state = logs
 
-        return self.state, reward, self.done, {}
+        return self._state, reward, self.done, {}
 
     def state(self):
-        return self.state
+        return self._state
 
     def action_space(self):
         return [

env/fake_server.py

@@ -60,6 +60,42 @@ def scan():
     return jsonify({"status": "scan detected"})
 
 
+# ---------------- SQL Injection Attack ----------------
+
+@app.route("/sql")
+def sql():
+    ip = request.remote_addr
+
+    logs["requests"].append({
+        "ip": ip,
+        "type": "sql_injection",
+        "time": time.time()
+    })
+
+    if ip not in logs["suspicious_ips"]:
+        logs["suspicious_ips"].append(ip)
+
+    return jsonify({"status": "sql injection detected"})
+
+
+# ---------------- Directory Traversal ----------------
+
+@app.route("/download")
+def download():
+    ip = request.remote_addr
+
+    logs["requests"].append({
+        "ip": ip,
+        "type": "directory_traversal",
+        "time": time.time()
+    })
+
+    if ip not in logs["suspicious_ips"]:
+        logs["suspicious_ips"].append(ip)
+
+    return jsonify({"status": "directory traversal attempt"})
+
+
 # Common scan endpoints
 
 @app.route("/admin")
@@ -95,7 +131,8 @@ def state():
         "failed_logins": logs["failed_logins"],
         "port_scans": logs["port_scans"],
         "suspicious_ips": logs["suspicious_ips"],
-        "total_requests": len(logs["requests"])
+        "total_requests": len(logs["requests"]),
+        "attack_types": [r["type"] for r in logs["requests"]]
     })
 
 
@@ -104,18 +141,21 @@ def state():
 @app.route("/reset", methods=["GET", "POST"])
 def reset():
     global logs
+
     logs = {
         "failed_logins": 0,
         "port_scans": 0,
         "suspicious_ips": [],
         "requests": []
     }
+
     return jsonify({
         "status": "reset",
         "success": True
     }), 200
 
-# ---------------- Step API (IMPORTANT) ----------------
+
+# ---------------- Step API ----------------
 
 @app.route("/step", methods=["GET", "POST"])
 def step():
@@ -128,17 +168,15 @@ def step():
 
     reward = 0.0
     done = False
-    # Detect brute force
+
     if action == "detect_bruteforce":
         if logs["failed_logins"] > 3:
             reward = 0.4
 
-    # Detect port scan
     elif action == "detect_portscan":
         if logs["port_scans"] > 0:
             reward = 0.3
 
-    # Mitigation step
     elif action == "mitigate_attack":
         if len(logs["suspicious_ips"]) > 0:
             reward = 1.0
@@ -152,6 +190,13 @@ def step():
     })
 
 
+# ---------------- Health Check ----------------
+
+@app.route("/health")
+def health():
+    return jsonify({"status": "ok"})
+
+
 # ---------------- Status ----------------
 
 @app.route("/status")
@@ -161,7 +206,9 @@ def status():
         "attacks": [
             "brute_force",
             "port_scan",
-            "credential_stuffing"
+            "credential_stuffing",
+            "sql_injection",
+            "directory_traversal"
         ],
         "status": "running"
     })

inference.py

@@ -7,11 +7,11 @@ from openai import OpenAI
 
 random.seed(42)
 
-from env.fake_server import run_server
+from server.app import main as run_server
 from env.env import DeceptionEnv
 from env.attacker import simulate_attack
 
-# Start server
+# Start server in background
 threading.Thread(target=run_server, daemon=True).start()
 time.sleep(2)
 
@@ -33,22 +33,23 @@ def run_task(task_name):
         env.reset()
 
         print(
-            f"[START] task={task_name} env=cyber-security model=AI-agent",
+            f"[START] task={task_name} env=cyber-security model={MODEL_NAME}",
             flush=True
         )
 
         rewards = []
+        done = False
 
         for step in range(1, 4):
 
             try:
                 simulate_attack()
-            except:
+            except Exception:
                 pass
 
             try:
                 state = env.state()
-            except:
+            except Exception:
                 pass
 
             # Required OpenAI call (validator requirement)
@@ -58,7 +59,7 @@ def run_task(task_name):
                     messages=[{"role": "user", "content": "choose action"}],
                     timeout=10
                 )
-            except:
+            except Exception:
                 pass
 
             # Task-specific logic
@@ -88,7 +89,7 @@ def run_task(task_name):
 
             state, reward, done, _ = env.step(action)
 
-            # keep reward strictly (0,1)
+            # clamp reward to (0,1)
             reward = min(max(reward, 0.05), 0.95)
 
             rewards.append(reward)
@@ -99,12 +100,18 @@ def run_task(task_name):
                 flush=True
             )
 
-        score = sum(rewards) / 3
+            if done:
+                break
+
+        steps = len(rewards)
+        score = sum(rewards) / steps if steps > 0 else 0.0
         score = min(max(score, 0.05), 0.95)
 
+        success = score >= 0.3
+
         print(
-            f"[END] success=true steps=3 "
-            f"score={score:.2f} rewards={','.join(f'{r:.2f}' for r in rewards)}",
+            f"[END] success={str(success).lower()} steps={steps} "
+            f"score={score:.3f} rewards={','.join(f'{r:.2f}' for r in rewards)}",
             flush=True
         )
 
@@ -116,10 +123,10 @@ def run_task(task_name):
         )
 
 
-# Run 3 Tasks
+# Run tasks
 run_task("easy")
 run_task("medium")
 run_task("hard")
 
-# allow validator reset calls
-time.sleep(120)
+# Keep space alive briefly for validation (3 min)
+time.sleep(180)

models.py

@@ -1,14 +1,20 @@
 from pydantic import BaseModel
-from typing import List
+from typing import List, Optional, Dict, Any
+
 
 class Observation(BaseModel):
     failed_logins: int
     port_scans: int
     suspicious_ips: List[str]
+    total_requests: Optional[int] = 0
+    attack_types: Optional[List[str]] = []
+
 
 class Action(BaseModel):
     action: str
 
+
 class Reward(BaseModel):
     reward: float
     done: bool
+    info: Optional[Dict[str, Any]] = {}

openenv.yaml

@@ -1,4 +1,6 @@
 name: ai-deception-env
+version: 1
+environment: cyber-security
 description: AI Cyber Deception Environment
 
 tasks:

requirements.txt

@@ -3,3 +3,5 @@ requests
 numpy
 pydantic
 openai
+gunicorn
+uvicorn

tasks/easy/grader.py

@@ -0,0 +1,9 @@
+def grade(reward):
+
+    if reward >= 0.4:
+        return 1.0
+
+    elif reward >= 0.2:
+        return 0.5
+
+    return 0.0

tasks/{easy.py → easy/task.py}

@@ -1,13 +1,14 @@
 from env.env import DeceptionEnv
 from env.attacker import brute_force
 
-def run():
 
-    brute_force()
+def run():
 
     env = DeceptionEnv()
     env.reset()
 
+    brute_force()
+
     _, reward, _, _ = env.step("detect_attack")
 
     return reward

tasks/hard/grader.py

@@ -0,0 +1,12 @@
+def grade(reward):
+
+    if reward >= 0.8:
+        return 1.0
+
+    elif reward >= 0.5:
+        return 0.7
+
+    elif reward >= 0.3:
+        return 0.4
+
+    return 0.0

tasks/{hard.py → hard/task.py}

@@ -1,15 +1,16 @@
 from env.env import DeceptionEnv
 from env.attacker import brute_force, port_scan, credential_stuffing
 
+
 def run():
 
+    env = DeceptionEnv()
+    env.reset()
+
     brute_force()
     port_scan()
     credential_stuffing()
 
-    env = DeceptionEnv()
-    env.reset()
-
     total_reward = 0
 
     _, r, _, _ = env.step("detect_attack")

tasks/medium/grader.py

@@ -0,0 +1,9 @@
+def grade(reward):
+
+    if reward >= 0.6:
+        return 1.0
+
+    elif reward >= 0.3:
+        return 0.5
+
+    return 0.0

tasks/{medium.py → medium/task.py}

@@ -1,13 +1,14 @@
 from env.env import DeceptionEnv
 from env.attacker import brute_force
 
-def run():
 
-    brute_force()
+def run():
 
     env = DeceptionEnv()
     env.reset()
 
+    brute_force()
+
     total_reward = 0
 
     _, r, _, _ = env.step("detect_attack")

tasks/test_tasks.py

@@ -1,6 +1,6 @@
-from tasks.easy import run as easy
-from tasks.medium import run as medium
-from tasks.hard import run as hard
+from tasks.easy.task import run as easy
+from tasks.medium.task import run as medium
+from tasks.hard.task import run as hard
 
 print("Easy:", easy())
 print("Medium:", medium())