Upload 18 files

.gitattributes

@@ -33,3 +33,6 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+dashboard/static/logo.png filter=lfs diff=lfs merge=lfs -text
+database/security_events.db filter=lfs diff=lfs merge=lfs -text
+geoip/GeoLite2-Country.mmdb filter=lfs diff=lfs merge=lfs -text

dashboard/app.py

@@ -0,0 +1,600 @@
+from flask import Flask, render_template_string, jsonify, request, send_file
+import sys
+import os
+import io
+from datetime import datetime
+from collections import Counter
+from reportlab.lib.pagesizes import letter
+from reportlab.pdfgen import canvas
+from reportlab.lib.utils import ImageReader
+from reportlab.lib.units import inch
+from scapy.utils import wrpcap
+import tempfile
+
+sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from database.db import Database
+from response.block_ip import block_ip_windows, unblock_ip_windows
+from geoip.blocker import GeoIPBlocker
+
+app = Flask(__name__)
+db = None
+pcap_sniffer = None
+geoip = None
+geoip_available = False
+
+# ---------- PDF Helpers ----------
+def add_page_number(c, page_num):
+    c.saveState()
+    c.setFont("Helvetica", 8)
+    c.drawString(letter[0] - 80, 30, f"Page {page_num}")
+    c.restoreState()
+
+def draw_header(c, title, subtitle=""):
+    c.setFont("Helvetica-Bold", 16)
+    c.drawString(50, letter[1] - 50, title)
+    c.setFont("Helvetica", 10)
+    c.drawString(50, letter[1] - 70, subtitle)
+    c.line(50, letter[1] - 80, letter[0] - 50, letter[1] - 80)
+
+def draw_watermark(c, logo_path):
+    if os.path.exists(logo_path):
+        try:
+            img = ImageReader(logo_path)
+            c.saveState()
+            c.setFillAlpha(0.2)
+            c.drawImage(img, letter[0]/2 - 1.5*inch, letter[1]/2 - 1.5*inch,
+                        width=3*inch, height=3*inch, mask='auto', preserveAspectRatio=True)
+            c.restoreState()
+        except:
+            pass
+
+def generate_blocked_ips_pdf():
+    blocked = db.get_blocked_ips()
+    buffer = io.BytesIO()
+    c = canvas.Canvas(buffer, pagesize=letter)
+    logo_path = os.path.join(os.path.dirname(__file__), 'static', 'logo.png')
+    page_num = 1
+
+    draw_watermark(c, logo_path)
+    draw_header(c, "MayOne Security Framework", "Blocked IP Addresses Report")
+    y = letter[1] - 110
+    c.drawString(50, y, f"Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
+    y -= 20
+    c.drawString(50, y, f"Total Blocked IPs: {len(blocked)}")
+    y -= 40
+
+    c.setFont("Helvetica-Bold", 10)
+    c.drawString(50, y, "IP Address")
+    c.drawString(160, y, "Blocked Since")
+    c.drawString(300, y, "Reason")
+    c.setFont("Helvetica", 10)
+    y -= 20
+
+    for ip, block_time, reason in blocked:
+        if y < 80:
+            draw_watermark(c, logo_path)
+            add_page_number(c, page_num)
+            c.showPage()
+            page_num += 1
+            draw_header(c, "MayOne Security Framework (cont.)", "Blocked IPs")
+            y = letter[1] - 110
+            c.setFont("Helvetica-Bold", 10)
+            c.drawString(50, y, "IP Address")
+            c.drawString(160, y, "Blocked Since")
+            c.drawString(300, y, "Reason")
+            c.setFont("Helvetica", 10)
+            y -= 20
+        reason_short = reason[:60] + "..." if len(reason) > 60 else reason
+        c.drawString(50, y, ip)
+        c.drawString(160, y, block_time[:19])
+        c.drawString(300, y, reason_short)
+        y -= 20
+
+    add_page_number(c, page_num)
+    c.save()
+    buffer.seek(0)
+    return buffer
+
+def generate_all_ips_pdf():
+    events = db.get_recent_events(limit=1000)
+    buffer = io.BytesIO()
+    c = canvas.Canvas(buffer, pagesize=letter)
+    logo_path = os.path.join(os.path.dirname(__file__), 'static', 'logo.png')
+    page_num = 1
+
+    draw_watermark(c, logo_path)
+    draw_header(c, "MayOne Security Framework", "Complete IP Traffic Log")
+    y = letter[1] - 110
+    c.drawString(50, y, f"Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
+    y -= 20
+    c.drawString(50, y, f"Total Events: {len(events)}")
+    y -= 40
+
+    headers = ["Timestamp", "Src IP", "Dst IP", "Proto", "Port", "Size", "Threat", "Risk"]
+    col_widths = [100, 80, 80, 40, 40, 50, 70, 40]
+    c.setFont("Helvetica-Bold", 8)
+    x = 50
+    for i, h in enumerate(headers):
+        c.drawString(x, y, h)
+        x += col_widths[i]
+    c.setFont("Helvetica", 8)
+    y -= 15
+
+    for ev in events:
+        if y < 80:
+            draw_watermark(c, logo_path)
+            add_page_number(c, page_num)
+            c.showPage()
+            page_num += 1
+            draw_header(c, "MayOne Security Framework (cont.)", "IP Traffic Log")
+            y = letter[1] - 110
+            c.setFont("Helvetica-Bold", 8)
+            x = 50
+            for i, h in enumerate(headers):
+                c.drawString(x, y, h)
+                x += col_widths[i]
+            c.setFont("Helvetica", 8)
+            y -= 15
+        ts = ev[1][:19] if len(ev[1]) > 19 else ev[1]
+        src = ev[2][:15]
+        dst = ev[3][:15]
+        proto = ev[4][:4]
+        port = str(ev[5]) if ev[5] else ""
+        size = str(ev[6])
+        threat = ev[7] or "Normal"
+        risk = str(ev[8]) if ev[8] else "0"
+        x = 50
+        c.drawString(x, y, ts); x += col_widths[0]
+        c.drawString(x, y, src); x += col_widths[1]
+        c.drawString(x, y, dst); x += col_widths[2]
+        c.drawString(x, y, proto); x += col_widths[3]
+        c.drawString(x, y, port); x += col_widths[4]
+        c.drawString(x, y, size); x += col_widths[5]
+        c.drawString(x, y, threat); x += col_widths[6]
+        c.drawString(x, y, risk)
+        y -= 12
+
+    add_page_number(c, page_num)
+    c.save()
+    buffer.seek(0)
+    return buffer
+
+# ---------- HTML Template (with GeoIP warning and conditional toggle) ----------
+HTML_TEMPLATE = '''
+<!DOCTYPE html>
+<html>
+<head>
+    <title>MayOne Security Framework</title>
+    <meta charset="UTF-8">
+    <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.min.js"></script>
+    <style>
+        * { box-sizing: border-box; }
+        body { font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; margin: 0; background: #0a0f1e; color: #eef4ff; padding: 20px; }
+        .container { max-width: 1400px; margin: 0 auto; }
+        .header { display: flex; align-items: center; gap: 20px; margin-bottom: 30px; border-bottom: 2px solid #2a3f6e; padding-bottom: 15px; }
+        .logo { height: 60px; width: auto; }
+        h1 { margin: 0; font-size: 2rem; background: linear-gradient(135deg, #ff6b6b, #4ecdc4); -webkit-background-clip: text; background-clip: text; color: transparent; }
+        .subtitle { color: #8e9aaf; margin-top: 5px; }
+        .card { background: #141b2b; border-radius: 16px; padding: 20px; margin-bottom: 25px; box-shadow: 0 8px 20px rgba(0,0,0,0.3); border: 1px solid #2a3f6e; }
+        .card h2 { margin-top: 0; color: #4ecdc4; font-size: 1.5rem; }
+        .stats-grid { display: flex; gap: 20px; flex-wrap: wrap; }
+        .stat-box { background: #0f172a; padding: 15px 25px; border-radius: 12px; flex: 1; min-width: 150px; text-align: center; border-left: 4px solid #4ecdc4; }
+        .stat-number { font-size: 2rem; font-weight: bold; color: #ffd966; }
+        .chart-container { display: flex; gap: 20px; flex-wrap: wrap; }
+        .chart-box { flex: 1; min-width: 250px; background: #0f172a; border-radius: 12px; padding: 15px; }
+        canvas { max-height: 300px; width: 100%; }
+        table { width: 100%; border-collapse: collapse; }
+        th, td { text-align: left; padding: 12px; border-bottom: 1px solid #2a3f6e; }
+        th { background: #1e2a3a; color: #4ecdc4; }
+        .critical { color: #ff6b6b; font-weight: bold; }
+        .high { color: #ffa64d; }
+        .medium { color: #ffd966; }
+        .form-group { display: flex; gap: 10px; flex-wrap: wrap; align-items: flex-end; }
+        .form-field { flex: 1; }
+        label { display: block; font-size: 0.8rem; margin-bottom: 5px; color: #8e9aaf; }
+        input, textarea { width: 100%; padding: 10px; background: #0f172a; border: 1px solid #2a3f6e; border-radius: 8px; color: #eef4ff; font-size: 0.9rem; }
+        button { background: #4ecdc4; color: #0a0f1e; border: none; padding: 10px 20px; border-radius: 8px; cursor: pointer; font-weight: bold; transition: 0.2s; }
+        button.danger { background: #ff6b6b; }
+        button.secondary { background: #2a3f6e; color: white; }
+        button:hover { opacity: 0.85; transform: translateY(-2px); }
+        .alert { padding: 10px; border-radius: 8px; margin-bottom: 15px; display: none; }
+        .alert-success { background: #2e7d64; color: white; }
+        .alert-error { background: #b91c1c; color: white; }
+        .toolbar { display: flex; justify-content: space-between; align-items: center; margin-bottom: 15px; flex-wrap: wrap; gap: 10px; }
+        .warning { background: #ffaa44; color: #0a0f1e; padding: 10px 15px; border-radius: 8px; margin-bottom: 20px; font-weight: bold; }
+        footer { text-align: center; margin-top: 30px; font-size: 0.8rem; color: #5a6e8a; }
+    </style>
+</head>
+<body>
+<div class="container">
+    <div class="header">
+        <img src="/static/logo.png" alt="MayOne Logo" class="logo" onerror="this.style.display='none'">
+        <div>
+            <h1>🛡️ MayOne Security Framework</h1>
+            <div class="subtitle">AI‑powered Intrusion Detection & Response</div>
+        </div>
+    </div>
+    <div id="alertBox" class="alert"></div>
+    <div id="geoipWarning" class="warning" style="display: none;">
+        ⚠️ GeoIP database not found. Download GeoLite2-Country.mmdb and place it in the 'geoip/' folder to enable country lookup and automatic blocking.
+    </div>
+    <div class="card">
+        <h2>📊 Live Statistics</h2>
+        <div class="stats-grid">
+            <div class="stat-box"><div class="stat-number" id="totalEvents">0</div><div>Total Events</div></div>
+            <div class="stat-box"><div class="stat-number" id="uniqueSrc">0</div><div>Unique Sources</div></div>
+            <div class="stat-box"><div class="stat-number" id="blockedCount">0</div><div>Blocked IPs</div></div>
+        </div>
+    </div>
+    <div class="card">
+        <h2>📡 Traffic Analysis</h2>
+        <div class="chart-container">
+            <div class="chart-box"><h3>Protocol Distribution</h3><canvas id="protocolChart"></canvas></div>
+            <div class="chart-box"><h3>Top 5 Ports</h3><canvas id="portChart"></canvas></div>
+        </div>
+    </div>
+    <div class="card">
+        <h2>🚨 Recent Threats</h2>
+        <div style="overflow-x: auto;">
+            <table id="threatsTable">
+                <thead>
+                    <tr>
+                        <th>Time</th>
+                        <th>Source IP</th>
+                        <th>Country</th>
+                        <th>Protocol</th>
+                        <th>Dest Port</th>
+                        <th>Threat Type</th>
+                        <th>Risk</th>
+                        <th>Action</th>
+                    </tr>
+                </thead>
+                <tbody id="threatsBody">
+                    <tr><td colspan="8">Loading...</td></tr>
+                </tbody>
+            </table>
+        </div>
+    </div>
+    <div class="card">
+        <div class="toolbar">
+            <h2>🚫 Blocked IPs & Manual Control</h2>
+            <div style="display: flex; gap: 15px; align-items: center;">
+                <label id="geoipLabel" style="display: inline-flex; align-items: center; gap: 8px; background: #1e2a3a; padding: 5px 12px; border-radius: 20px;">
+                    🌍 GeoIP Blocking
+                    <input type="checkbox" id="geoipToggle" style="width: 18px; height: 18px; margin: 0;">
+                </label>
+                <button id="downloadBlockedPdfBtn" class="secondary">📄 Blocked IPs (PDF)</button>
+                <button id="downloadAllPdfBtn" class="secondary">📊 All IP Logs (PDF)</button>
+                <button id="downloadPcapBtn" class="secondary">📦 Download PCAP</button>
+            </div>
+        </div>
+        <div class="form-group" style="margin-bottom: 25px;">
+            <div class="form-field"><label>IP Address to Block</label><input type="text" id="blockIp" placeholder="e.g., 203.0.113.5"></div>
+            <div class="form-field"><label>Reason (optional)</label><input type="text" id="blockReason" placeholder="Manual block"></div>
+            <button id="blockBtn">➕ Block IP</button>
+        </div>
+        <div style="overflow-x: auto;">
+            <table id="blockedTable">
+                <thead>
+                    <tr><th>IP Address</th><th>Blocked Since</th><th>Reason</th><th>Action</th></tr>
+                </thead>
+                <tbody id="blockedBody">
+                    <tr><td colspan="4">Loading...</td></tr>
+                </tbody>
+            </table>
+        </div>
+    </div>
+    <footer>MayOne Security Framework — Real‑time monitoring | Auto‑refresh every 3s</footer>
+</div>
+
+<script>
+    let protocolChart, portChart;
+    let geoipAvailable = {{ geoip_available|tojson }};
+
+    if (!geoipAvailable) {
+        document.getElementById('geoipWarning').style.display = 'block';
+        document.getElementById('geoipToggle').disabled = true;
+        document.getElementById('geoipLabel').style.opacity = '0.6';
+    }
+
+    function showAlert(message, type) {
+        const alertDiv = document.getElementById('alertBox');
+        alertDiv.textContent = message;
+        alertDiv.className = `alert alert-${type}`;
+        alertDiv.style.display = 'block';
+        setTimeout(() => { alertDiv.style.display = 'none'; }, 4000);
+    }
+
+    async function fetchStats() {
+        try {
+            const res = await fetch('/api/stats');
+            const data = await res.json();
+            document.getElementById('totalEvents').innerText = data.total_events;
+            document.getElementById('uniqueSrc').innerText = data.unique_src;
+            document.getElementById('blockedCount').innerText = data.blocked_count;
+        } catch(e) { console.error('Stats error', e); }
+    }
+
+    async function fetchTrafficStats() {
+        try {
+            const res = await fetch('/api/traffic_stats');
+            const data = await res.json();
+            if (protocolChart) protocolChart.destroy();
+            const protoCtx = document.getElementById('protocolChart').getContext('2d');
+            protocolChart = new Chart(protoCtx, {
+                type: 'pie',
+                data: { labels: Object.keys(data.protocols), datasets: [{ data: Object.values(data.protocols), backgroundColor: ['#4ecdc4', '#ff6b6b', '#ffd966', '#a78bfa'] }] },
+                options: { responsive: true, maintainAspectRatio: true, plugins: { legend: { labels: { color: '#eef4ff' } } } }
+            });
+            if (portChart) portChart.destroy();
+            const portCtx = document.getElementById('portChart').getContext('2d');
+            const portLabels = Object.keys(data.top_ports);
+            const portValues = Object.values(data.top_ports);
+            portChart = new Chart(portCtx, {
+                type: 'bar',
+                data: { labels: portLabels, datasets: [{ label: 'Packets', data: portValues, backgroundColor: '#4ecdc4' }] },
+                options: { responsive: true, maintainAspectRatio: true, scales: { y: { beginAtZero: true, ticks: { color: '#eef4ff' } }, x: { ticks: { color: '#eef4ff' } } }, plugins: { legend: { labels: { color: '#eef4ff' } } } }
+            });
+        } catch(e) { console.error('Traffic stats error', e); }
+    }
+
+    async function fetchThreats() {
+        try {
+            const res = await fetch('/api/threats');
+            const threats = await res.json();
+            const tbody = document.getElementById('threatsBody');
+            if(threats.length === 0) { tbody.innerHTML = '<tr><td colspan="8">No threats detected</td></tr>'; return; }
+            tbody.innerHTML = threats.map(t => `
+                <tr>
+                    <td>${t.time.slice(0,19)}</td>
+                    <td>${t.src_ip}</td>
+                    <td>${t.country || '-'}</td>
+                    <td>${t.protocol || '-'}</td>
+                    <td>${t.port || '-'}</td>
+                    <td>${t.threat_type || 'ANOMALY'}</td>
+                    <td class="${t.risk >= 80 ? 'critical' : (t.risk >= 60 ? 'high' : (t.risk >= 30 ? 'medium' : ''))}">${t.risk}</td>
+                    <td>${t.action || '-'}</td>
+                </tr>
+            `).join('');
+        } catch(e) { console.error('Threats error', e); }
+    }
+
+    async function fetchBlockedIPs() {
+        try {
+            const res = await fetch('/api/blocked_ips');
+            const blocked = await res.json();
+            const tbody = document.getElementById('blockedBody');
+            if(blocked.length === 0) { tbody.innerHTML = '<tr><td colspan="4">No IPs blocked</td></tr>'; return; }
+            tbody.innerHTML = blocked.map(b => `
+                <tr>
+                    <td>${b.ip}</td>
+                    <td>${b.time.slice(0,19)}</td>
+                    <td>${b.reason}</td>
+                    <td><button class="danger" onclick="unblockIP('${b.ip}')">Unblock</button></td>
+                </tr>
+            `).join('');
+        } catch(e) { console.error('Blocked IPs error', e); }
+    }
+
+    async function fetchGeoIPStatus() {
+        if (!geoipAvailable) return;
+        try {
+            const res = await fetch('/api/geoip_status');
+            const data = await res.json();
+            document.getElementById('geoipToggle').checked = data.enabled;
+        } catch(e) { console.error('GeoIP status error', e); }
+    }
+
+    async function blockIP() {
+        const ip = document.getElementById('blockIp').value.trim();
+        if(!ip) { showAlert('Please enter an IP address', 'error'); return; }
+        const reason = document.getElementById('blockReason').value.trim() || 'Manual block from dashboard';
+        try {
+            const res = await fetch('/api/block', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({ip: ip, reason: reason}) });
+            const data = await res.json();
+            if(data.success) {
+                showAlert(`Blocked ${ip} successfully`, 'success');
+                document.getElementById('blockIp').value = '';
+                document.getElementById('blockReason').value = '';
+                fetchBlockedIPs(); fetchStats();
+            } else { showAlert(`Failed: ${data.error}`, 'error'); }
+        } catch(e) { showAlert('Network error', 'error'); }
+    }
+
+    window.unblockIP = async function(ip) {
+        if(!confirm(`Unblock ${ip}?`)) return;
+        try {
+            const res = await fetch('/api/unblock', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({ip: ip}) });
+            const data = await res.json();
+            if(data.success) {
+                showAlert(`Unblocked ${ip}`, 'success');
+                fetchBlockedIPs(); fetchStats();
+            } else { showAlert(`Failed: ${data.error}`, 'error'); }
+        } catch(e) { showAlert('Network error', 'error'); }
+    };
+
+    document.getElementById('downloadBlockedPdfBtn').addEventListener('click', () => window.location.href = '/api/download_blocked_ips_pdf');
+    document.getElementById('downloadAllPdfBtn').addEventListener('click', () => window.location.href = '/api/download_all_ips_pdf');
+    document.getElementById('downloadPcapBtn').addEventListener('click', () => window.location.href = '/api/download_pcap');
+
+    if (geoipAvailable) {
+        document.getElementById('geoipToggle').addEventListener('change', async (e) => {
+            const enabled = e.target.checked;
+            try {
+                const res = await fetch('/api/geoip_toggle', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({enabled: enabled}) });
+                const data = await res.json();
+                if(data.success) showAlert(`GeoIP blocking ${enabled ? 'enabled' : 'disabled'}`, 'success');
+                else showAlert('Failed to toggle GeoIP', 'error');
+            } catch(e) { showAlert('Network error', 'error'); }
+        });
+    }
+
+    function refreshAll() {
+        fetchStats();
+        fetchTrafficStats();
+        fetchThreats();
+        fetchBlockedIPs();
+        if (geoipAvailable) fetchGeoIPStatus();
+    }
+    setInterval(refreshAll, 3000);
+    refreshAll();
+    document.getElementById('blockBtn').addEventListener('click', blockIP);
+</script>
+</body>
+</html>
+'''
+
+# ---------- Flask Routes ----------
+@app.route('/')
+def dashboard():
+    return render_template_string(HTML_TEMPLATE, geoip_available=geoip_available)
+
+@app.route('/api/stats')
+def api_stats():
+    total_events = db.get_total_event_count()
+    conn, cursor = db._get_connection()
+    cursor.execute('SELECT DISTINCT src_ip FROM events')
+    unique_src = len(cursor.fetchall())
+    blocked = db.get_blocked_ips()
+    return jsonify({
+        'total_events': total_events,
+        'unique_src': unique_src,
+        'blocked_count': len(blocked)
+    })
+
+@app.route('/api/traffic_stats')
+def api_traffic_stats():
+    events = db.get_recent_events(limit=2000)
+    protocol_counter = Counter()
+    port_counter = Counter()
+    for ev in events:
+        proto = ev[4]
+        port = ev[5]
+        protocol_counter[proto] += 1
+        if port:
+            port_counter[port] += 1
+    top_ports = dict(port_counter.most_common(5))
+    return jsonify({
+        'protocols': dict(protocol_counter),
+        'top_ports': top_ports
+    })
+
+@app.route('/api/threats')
+def api_threats():
+    events = db.get_recent_events(500)
+    threats = []
+    for e in events:
+        if e[7] or e[8] > 0:
+            src_ip = e[2]
+            country = None
+            if geoip and geoip.reader:
+                country = geoip.get_country_code(src_ip)
+            threats.append({
+                'time': e[1],
+                'src_ip': src_ip,
+                'country': country,
+                'protocol': e[4],
+                'port': e[5] if e[5] else None,
+                'threat_type': e[7] or 'MONITORED',
+                'risk': e[8],
+                'action': e[9]
+            })
+    return jsonify(threats[:100])
+
+@app.route('/api/blocked_ips')
+def api_blocked_ips():
+    blocked = db.get_blocked_ips()
+    return jsonify([{'ip': b[0], 'time': b[1], 'reason': b[2]} for b in blocked])
+
+@app.route('/api/block', methods=['POST'])
+def api_block():
+    data = request.get_json()
+    ip = data.get('ip', '').strip()
+    reason = data.get('reason', 'Manual block from dashboard')
+    if not ip:
+        return jsonify({'success': False, 'error': 'IP required'}), 400
+    success = block_ip_windows(ip, reason)
+    if success:
+        db.insert_blocked_ip(ip, reason)
+        return jsonify({'success': True})
+    else:
+        return jsonify({'success': False, 'error': 'Firewall rule failed'}), 500
+
+@app.route('/api/unblock', methods=['POST'])
+def api_unblock():
+    data = request.get_json()
+    ip = data.get('ip', '').strip()
+    if not ip:
+        return jsonify({'success': False, 'error': 'IP required'}), 400
+    success = unblock_ip_windows(ip)
+    if success:
+        conn, cursor = db._get_connection()
+        cursor.execute('DELETE FROM blocked_ips WHERE ip = ?', (ip,))
+        conn.commit()
+        return jsonify({'success': True})
+    else:
+        return jsonify({'success': False, 'error': 'Unblock failed'}), 500
+
+@app.route('/api/download_blocked_ips_pdf')
+def download_blocked_ips_pdf():
+    pdf_buffer = generate_blocked_ips_pdf()
+    return send_file(pdf_buffer, as_attachment=True, download_name='blocked_ips_log.pdf', mimetype='application/pdf')
+
+@app.route('/api/download_all_ips_pdf')
+def download_all_ips_pdf():
+    pdf_buffer = generate_all_ips_pdf()
+    return send_file(pdf_buffer, as_attachment=True, download_name='all_ip_traffic_log.pdf', mimetype='application/pdf')
+
+@app.route('/api/download_pcap')
+def download_pcap():
+    if not pcap_sniffer:
+        return jsonify({'error': 'PCAP capture not available'}), 500
+    packets = pcap_sniffer.get_pcap_buffer()
+    if not packets:
+        return jsonify({'error': 'No packets captured yet'}), 404
+    try:
+        with tempfile.NamedTemporaryFile(delete=False, suffix='.pcap') as tmp:
+            wrpcap(tmp.name, packets)
+            tmp_path = tmp.name
+        with open(tmp_path, 'rb') as f:
+            pcap_data = f.read()
+        os.unlink(tmp_path)
+        return send_file(io.BytesIO(pcap_data), as_attachment=True, download_name='capture.pcap', mimetype='application/vnd.tcpdump.pcap')
+    except Exception as e:
+        app.logger.error(f"PCAP export failed: {e}")
+        return jsonify({'error': str(e)}), 500
+
+@app.route('/api/geoip_status')
+def geoip_status():
+    import main
+    return jsonify({'enabled': getattr(main, 'geoip_enabled', False)})
+
+@app.route('/api/geoip_toggle', methods=['POST'])
+def geoip_toggle():
+    import main
+    data = request.get_json()
+    main.geoip_enabled = data.get('enabled', False)
+    return jsonify({'success': True})
+
+@app.route('/static/<path:filename>')
+def serve_static(filename):
+    from flask import send_from_directory
+    static_dir = os.path.join(os.path.dirname(__file__), 'static')
+    return send_from_directory(static_dir, filename)
+
+# ---------- Startup ----------
+def run_dashboard(host='127.0.0.1', port=5000, sniffer=None):
+    global db, pcap_sniffer, geoip, geoip_available
+    db = Database()
+    pcap_sniffer = sniffer
+    geoip = GeoIPBlocker()
+    geoip_available = geoip.reader is not None
+    if not geoip_available:
+        print("[Dashboard] GeoIP database not found. Country lookup and blocking disabled.")
+    static_folder = os.path.join(os.path.dirname(__file__), 'static')
+    os.makedirs(static_folder, exist_ok=True)
+    logo_path = os.path.join(static_folder, 'logo.png')
+    if not os.path.exists(logo_path):
+        print("[Dashboard] No logo.png found in dashboard/static/. Please add your logo for watermark.")
+    app.run(host=host, port=port, debug=False, use_reloader=False)

database/db.py

@@ -0,0 +1,125 @@
+import sqlite3
+import threading
+from datetime import datetime
+import os
+from config import DB_PATH
+
+class Database:
+    _local = threading.local()
+
+    def __init__(self):
+        self._ensure_db_dir()
+        self._get_connection()  # create tables for the calling thread
+
+    def _ensure_db_dir(self):
+        os.makedirs(os.path.dirname(DB_PATH), exist_ok=True)
+
+    def _get_connection(self):
+        if not hasattr(self._local, 'conn'):
+            self._local.conn = sqlite3.connect(DB_PATH, check_same_thread=False)
+            self._local.cursor = self._local.conn.cursor()
+            self._create_tables(self._local.cursor)
+        return self._local.conn, self._local.cursor
+
+    def _create_tables(self, cursor):
+        cursor.execute('''
+            CREATE TABLE IF NOT EXISTS events (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                timestamp TEXT,
+                src_ip TEXT,
+                dst_ip TEXT,
+                protocol TEXT,
+                port INTEGER,
+                packet_size INTEGER,
+                threat_type TEXT,
+                risk_score INTEGER,
+                action TEXT
+            )
+        ''')
+        cursor.execute('''
+            CREATE TABLE IF NOT EXISTS threats (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                timestamp TEXT,
+                src_ip TEXT,
+                threat_type TEXT,
+                risk_score INTEGER,
+                details TEXT
+            )
+        ''')
+        cursor.execute('''
+            CREATE TABLE IF NOT EXISTS blocked_ips (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                ip TEXT UNIQUE,
+                block_time TEXT,
+                reason TEXT
+            )
+        ''')
+        cursor.execute('''
+            CREATE TABLE IF NOT EXISTS reports (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                timestamp TEXT,
+                report_path TEXT,
+                type TEXT
+            )
+        ''')
+        self._local.conn.commit()
+
+    def insert_event(self, src_ip, dst_ip, protocol, port, pkt_size, threat_type, risk_score, action):
+        conn, cursor = self._get_connection()
+        ts = datetime.now().isoformat()
+        cursor.execute('''
+            INSERT INTO events (timestamp, src_ip, dst_ip, protocol, port, packet_size, threat_type, risk_score, action)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ''', (ts, src_ip, dst_ip, protocol, port, pkt_size, threat_type, risk_score, action))
+        conn.commit()
+
+    def insert_threat(self, src_ip, threat_type, risk_score, details=""):
+        conn, cursor = self._get_connection()
+        ts = datetime.now().isoformat()
+        cursor.execute('''
+            INSERT INTO threats (timestamp, src_ip, threat_type, risk_score, details)
+            VALUES (?, ?, ?, ?, ?)
+        ''', (ts, src_ip, threat_type, risk_score, details))
+        conn.commit()
+
+    def insert_blocked_ip(self, ip, reason):
+        conn, cursor = self._get_connection()
+        ts = datetime.now().isoformat()
+        try:
+            cursor.execute('''
+                INSERT INTO blocked_ips (ip, block_time, reason)
+                VALUES (?, ?, ?)
+            ''', (ip, ts, reason))
+            conn.commit()
+        except sqlite3.IntegrityError:
+            pass
+
+    def get_recent_events(self, limit=100):
+        _, cursor = self._get_connection()
+        cursor.execute('SELECT * FROM events ORDER BY timestamp DESC LIMIT ?', (limit,))
+        return cursor.fetchall()
+
+    def get_threat_summary(self, hours=24):
+        _, cursor = self._get_connection()
+        cursor.execute('''
+            SELECT threat_type, COUNT(*), AVG(risk_score) FROM threats
+            WHERE timestamp > datetime('now', '-' || ? || ' hours')
+            GROUP BY threat_type
+        ''', (hours,))
+        return cursor.fetchall()
+
+    def get_blocked_ips(self):
+        _, cursor = self._get_connection()
+        cursor.execute('SELECT ip, block_time, reason FROM blocked_ips ORDER BY block_time DESC')
+        return cursor.fetchall()
+
+    def get_total_event_count(self):
+        _, cursor = self._get_connection()
+        cursor.execute('SELECT COUNT(*) FROM events')
+        return cursor.fetchone()[0]
+
+    def close(self):
+        if hasattr(self._local, 'conn'):
+            self._local.conn.close()
+            del self._local.conn
+            del self._local.cursor

database/security_events.db

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:af050a8eff07647ff4d84b9423ebbf14d368a1273bee669ef4125852ce1bfc90
+size 16191488

detection/threat_detector.py

@@ -0,0 +1,49 @@
+import time
+from collections import defaultdict, deque
+import threading
+
+class ThreatDetector:
+    def __init__(self, time_window=10, port_scan_th=20, brute_th=10, ddos_th=100, burst_th=50):
+        self.time_window = time_window
+        self.port_scan_th = port_scan_th
+        self.brute_th = brute_th
+        self.ddos_th = ddos_th
+        self.burst_th = burst_th
+        self.src_ports = defaultdict(lambda: deque())
+        self.src_packets = defaultdict(lambda: deque())
+        self.lock = threading.Lock()
+
+    def _clean_old(self, src_ip, current_time):
+        while self.src_ports[src_ip] and self.src_ports[src_ip][0][0] < current_time - self.time_window:
+            self.src_ports[src_ip].popleft()
+        while self.src_packets[src_ip] and self.src_packets[src_ip][0][0] < current_time - self.time_window:
+            self.src_packets[src_ip].popleft()
+
+    def detect(self, packet_info):
+        src = packet_info['src_ip']
+        port = packet_info['port']
+        ts = packet_info['timestamp']
+        threats = []
+
+        with self.lock:
+            if port:
+                self.src_ports[src].append((ts, port))
+            self.src_packets[src].append((ts, packet_info['size']))
+            self._clean_old(src, ts)
+
+            unique_ports = {p for _, p in self.src_ports[src]}
+            if len(unique_ports) >= self.port_scan_th:
+                threats.append(('PORT_SCAN', min(100, 60 + len(unique_ports))))
+
+            if port in [22, 23, 3389, 5900, 21] and len(self.src_packets[src]) >= self.brute_th:
+                threats.append(('BRUTE_FORCE', min(100, 70 + len(self.src_packets[src]))))
+
+            pkt_rate = len(self.src_packets[src]) / self.time_window
+            if pkt_rate > self.ddos_th:
+                threats.append(('DDoS_FLOOD', min(100, 80 + int(pkt_rate - self.ddos_th))))
+
+            recent_sizes = [size for t, size in self.src_packets[src] if t > ts - 1]
+            if len(recent_sizes) >= self.burst_th:
+                threats.append(('BURST', min(100, 65 + len(recent_sizes))))
+
+        return threats

geoip/GeoLite2-Country.mmdb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f5e80a9a3129d46e75c8cccd66bfac725b0449a6c89ba5093a16561d58f20bda
+size 9536434

geoip/blocker.py

@@ -0,0 +1,30 @@
+import geoip2.database
+import os
+from config import GEOIP_DB_PATH, HIGH_RISK_COUNTRIES
+
+class GeoIPBlocker:
+    def __init__(self):
+        self.reader = None
+        if os.path.exists(GEOIP_DB_PATH):
+            try:
+                self.reader = geoip2.database.Reader(GEOIP_DB_PATH)
+                print("[GeoIP] Database loaded successfully.")
+            except Exception as e:
+                print(f"[GeoIP] Failed to load database: {e}")
+        else:
+            print(f"[GeoIP] Database not found at {GEOIP_DB_PATH}. GeoIP blocking disabled.")
+
+    def get_country_code(self, ip):
+        if not self.reader:
+            return None
+        try:
+            response = self.reader.country(ip)
+            return response.country.iso_code
+        except:
+            return None
+
+    def is_high_risk(self, ip):
+        if not self.reader:
+            return False
+        code = self.get_country_code(ip)
+        return code in HIGH_RISK_COUNTRIES if code else False

logs/security.log

@@ -0,0 +1,11 @@
+import logging
+
+logging.basicConfig(
+    filename="logs/security.log",
+    level=logging.INFO,
+    format="%(asctime)s - %(message)s"
+)
+
+def log_event(message):
+
+    logging.info(message)

monitor/packet_sniffer.py

@@ -0,0 +1,72 @@
+import threading
+import queue
+import time
+from scapy.all import sniff, IP, TCP, UDP, ICMP
+from collections import deque
+import logging
+
+logging.basicConfig(filename='logs/sniffer.log', level=logging.ERROR, 
+                    format='%(asctime)s - %(levelname)s - %(message)s')
+
+class PacketSniffer(threading.Thread):
+    def __init__(self, packet_queue, interface=None, pcap_buffer_size=10000):
+        super().__init__()
+        self.packet_queue = packet_queue
+        self.interface = interface
+        self.running = True
+        self.daemon = True
+        self.raw_packets = deque(maxlen=pcap_buffer_size)   # store raw packets for PCAP
+        self.lock = threading.Lock()
+
+    def run(self):
+        try:
+            sniff(iface=self.interface, prn=self._process_packet, store=0, stop_filter=self._stop_filter)
+        except Exception as e:
+            logging.error(f"Sniffer error: {e}")
+
+    def _process_packet(self, packet):
+        if not self.running:
+            return
+        # Store raw packet for PCAP export
+        with self.lock:
+            self.raw_packets.append(packet)
+        try:
+            if IP in packet:
+                src = packet[IP].src
+                dst = packet[IP].dst
+                proto = packet[IP].proto
+                size = len(packet)
+                ts = time.time()
+                port = None
+                if TCP in packet:
+                    port = packet[TCP].dport
+                    proto_name = "TCP"
+                elif UDP in packet:
+                    port = packet[UDP].dport
+                    proto_name = "UDP"
+                elif ICMP in packet:
+                    proto_name = "ICMP"
+                else:
+                    proto_name = "OTHER"
+                
+                packet_info = {
+                    'timestamp': ts,
+                    'src_ip': src,
+                    'dst_ip': dst,
+                    'protocol': proto_name,
+                    'port': port,
+                    'size': size
+                }
+                self.packet_queue.put(packet_info)
+        except Exception as e:
+            logging.error(f"Error processing packet: {e}")
+
+    def _stop_filter(self, packet):
+        return not self.running
+
+    def get_pcap_buffer(self):
+        with self.lock:
+            return list(self.raw_packets)
+
+    def stop(self):
+        self.running = False

reports/report_generator.py

@@ -0,0 +1,118 @@
+import json
+import os
+from datetime import datetime
+from reportlab.lib.pagesizes import letter
+from reportlab.pdfgen import canvas
+from reportlab.lib.utils import simpleSplit
+
+class ReportGenerator:
+    def __init__(self, db):
+        self.db = db
+        self.report_dir = "reports"
+        os.makedirs(self.report_dir, exist_ok=True)
+
+    def _get_cursor(self):
+        _, cursor = self.db._get_connection()
+        return cursor
+
+    def generate_report(self, reason="scheduled"):
+        ts = datetime.now()
+        base_name = f"security_report_{ts.strftime('%Y%m%d_%H%M%S')}"
+        data = self._collect_data(ts)
+
+        json_path = os.path.join(self.report_dir, base_name + ".json")
+        with open(json_path, 'w') as f:
+            json.dump(data, f, indent=2)
+
+        txt_path = os.path.join(self.report_dir, base_name + ".txt")
+        with open(txt_path, 'w') as f:
+            f.write(self._format_text(data))
+
+        pdf_path = os.path.join(self.report_dir, base_name + ".pdf")
+        self._generate_pdf(data, pdf_path)
+
+        cursor = self._get_cursor()
+        cursor.execute('INSERT INTO reports (timestamp, report_path, type) VALUES (?, ?, ?)',
+                       (ts.isoformat(), json_path, reason))
+        self.db._get_connection()[0].commit()
+        return json_path, txt_path, pdf_path
+
+    def _collect_data(self, ts):
+        events = self.db.get_recent_events(200)
+        threats = self.db.get_threat_summary(24)
+        blocked = self.db.get_blocked_ips()
+        total_packets = len(events)
+        unique_src = set(e[2] for e in events)
+        return {
+            "report_time": ts.isoformat(),
+            "summary": {
+                "total_events": total_packets,
+                "unique_sources": len(unique_src),
+                "threats_detected": len([e for e in events if e[7] is not None]),
+                "blocked_ips": len(blocked)
+            },
+            "threat_breakdown": [{"type": t[0], "count": t[1], "avg_risk": t[2]} for t in threats],
+            "blocked_ips_list": [{"ip": b[0], "time": b[1], "reason": b[2]} for b in blocked],
+            "top_suspicious": self._get_top_ips(events),
+            "recommendations": self._generate_recs(threats, len(blocked))
+        }
+
+    def _get_top_ips(self, events, n=5):
+        freq = {}
+        for e in events:
+            ip = e[2]
+            freq[ip] = freq.get(ip, 0) + 1
+        sorted_ips = sorted(freq.items(), key=lambda x: x[1], reverse=True)[:n]
+        return [{"ip": ip, "packets": cnt} for ip, cnt in sorted_ips]
+
+    def _generate_recs(self, threats, blocked_count):
+        recs = []
+        if any(t[0] == "PORT_SCAN" for t in threats):
+            recs.append("Enable port knocking or move SSH/RDP to non-standard ports.")
+        if any(t[0] == "BRUTE_FORCE" for t in threats):
+            recs.append("Enforce strong passwords and consider account lockout policies.")
+        if blocked_count > 10:
+            recs.append("Review blocked IP list; consider using an IP reputation feed.")
+        if not recs:
+            recs.append("No immediate action required. Continue monitoring.")
+        return recs
+
+    def _format_text(self, data):
+        lines = []
+        lines.append("="*60)
+        lines.append(f"MayOne Security Report - {data['report_time']}")
+        lines.append("="*60)
+        lines.append("\nSUMMARY")
+        for k,v in data['summary'].items():
+            lines.append(f"  {k}: {v}")
+        lines.append("\nTHREAT BREAKDOWN")
+        for t in data['threat_breakdown']:
+            lines.append(f"  {t['type']}: {t['count']} events, avg risk {t['avg_risk']:.1f}")
+        lines.append("\nBLOCKED IPs")
+        for b in data['blocked_ips_list'][:10]:
+            lines.append(f"  {b['ip']} - {b['reason']} (since {b['time']})")
+        lines.append("\nRECOMMENDATIONS")
+        for r in data['recommendations']:
+            lines.append(f"  - {r}")
+        return "\n".join(lines)
+
+    def _generate_pdf(self, data, path):
+        c = canvas.Canvas(path, pagesize=letter)
+        width, height = letter
+        y = height - 50
+        c.drawString(50, y, f"MayOne Security Report - {data['report_time']}")
+        y -= 30
+        c.drawString(50, y, "Summary")
+        y -= 20
+        for k,v in data['summary'].items():
+            c.drawString(70, y, f"{k}: {v}")
+            y -= 15
+        y -= 10
+        c.drawString(50, y, "Top Recommendations")
+        y -= 20
+        for rec in data['recommendations'][:3]:
+            lines = simpleSplit(rec, "Helvetica", 12, width-100)
+            for line in lines:
+                c.drawString(70, y, f"- {line}")
+                y -= 15
+        c.save()

response/block_ip.py

@@ -0,0 +1,44 @@
+import subprocess
+import logging
+
+logging.basicConfig(filename='logs/response.log', level=logging.INFO)
+
+def block_ip_windows(ip, reason="Malicious activity"):
+    try:
+        rule_name_in = f"Block_IP_{ip.replace('.', '_')}_in"
+        rule_name_out = f"Block_IP_{ip.replace('.', '_')}_out"
+        
+        check_in = subprocess.run(f'netsh advfirewall firewall show rule name="{rule_name_in}"', shell=True, capture_output=True, text=True)
+        check_out = subprocess.run(f'netsh advfirewall firewall show rule name="{rule_name_out}"', shell=True, capture_output=True, text=True)
+        
+        if "No rules match" in check_in.stdout:
+            cmd_in = f'netsh advfirewall firewall add rule name="{rule_name_in}" dir=in action=block remoteip={ip}'
+            proc_in = subprocess.run(cmd_in, shell=True, capture_output=True, text=True)
+            if proc_in.returncode != 0:
+                logging.error(f"Failed to add inbound rule for {ip}: {proc_in.stderr}")
+                return False
+        
+        if "No rules match" in check_out.stdout:
+            cmd_out = f'netsh advfirewall firewall add rule name="{rule_name_out}" dir=out action=block remoteip={ip}'
+            proc_out = subprocess.run(cmd_out, shell=True, capture_output=True, text=True)
+            if proc_out.returncode != 0:
+                logging.error(f"Failed to add outbound rule for {ip}: {proc_out.stderr}")
+                return False
+        
+        logging.info(f"Blocked IP {ip} (inbound+outbound) - {reason}")
+        return True
+    except Exception as e:
+        logging.error(f"Exception blocking {ip}: {e}")
+        return False
+
+def unblock_ip_windows(ip):
+    try:
+        rule_name_in = f"Block_IP_{ip.replace('.', '_')}_in"
+        rule_name_out = f"Block_IP_{ip.replace('.', '_')}_out"
+        subprocess.run(f'netsh advfirewall firewall delete rule name="{rule_name_in}"', shell=True, capture_output=True)
+        subprocess.run(f'netsh advfirewall firewall delete rule name="{rule_name_out}"', shell=True, capture_output=True)
+        logging.info(f"Unblocked IP {ip}")
+        return True
+    except Exception as e:
+        logging.error(f"Exception unblocking {ip}: {e}")
+        return False