█████╗ ██╗ █████╗ ███████╗
██╔══██╗██║██╔══██╗██╔════╝
███████║██║███████║███████╗
██╔══██║██║██╔══██║╚════██║
██║ ██║██║██║ ██║███████║
╚═╝ ╚═╝╚═╝╚═╝ ╚═╝╚══════╝
AI Adaptive Security — ML-Powered Network Firewall
A self-learning firewall that doesn't just block — it understands.
"Traditional firewalls follow rules. AIAS writes its own."
How It Works · Architecture · Installation · Dashboard · Roadmap
AIAS (AI Adaptive Security) is a machine learning-powered network firewall that goes beyond static rules and signatures. While tools like pfSense, iptables, Snort, and Suricata rely on predefined rule sets, AIAS learns traffic behavior over time and autonomously adapts its filtering logic.
It is not just an IDS (Intrusion Detection System) that raises alerts. AIAS is an active AI filter — it detects, scores, logs, and enforces decisions on network traffic in real time, visualizing everything through a live web dashboard.
| Traditional Firewall | AIAS |
|---|---|
| Blocks by rules/signatures | Learns normal behavior, flags deviations |
| Needs manual rule updates | Auto-adapts over time |
| Binary allow/block | Anomaly scoring with confidence levels |
| Detect only (IDS) | Active enforcement |
| Blind to novel attacks | Catches zero-day patterns via ML |
AIAS operates in a continuous pipeline across three phases:
Raw network packets are captured from a live interface or loaded from a .pcap file. Each packet is parsed and normalized into feature vectors representing connection characteristics.
An Isolation Forest model — a proven unsupervised anomaly detection algorithm — scores each traffic event. It learns what "normal" looks like and assigns outlier scores to anything that deviates. No labeled attack data is required.
Events that exceed the anomaly threshold are flagged. Their IPs are added to the blocked list managed by the Rule Manager, which can hook into iptables/ufw for real firewall enforcement. Every decision is logged across three formats simultaneously.
┌─────────────────────────────────────────────────────────────────┐
│ AIAS PIPELINE │
│ │
│ ┌─────────────┐ ┌──────────────┐ ┌─────────────────┐ │
│ │ CAPTURE │────►│ FEATURES │────►│ DETECTION │ │
│ │ │ │ │ │ │ │
│ │ capture/ │ │ features/ │ │ detection/ │ │
│ │ ─ pcap load │ │ ─ extract │ │ ─ IsolationForest│ │
│ │ ─ live iface│ │ ─ normalize │ │ ─ anomaly score │ │
│ │ ─ simulator │ │ ─ vectorize │ │ ─ threshold │ │
│ └─────────────┘ └──────────────┘ └────────┬────────┘ │
│ │ │
│ ┌─────────────────────────────────────┘ │
│ ▼ │
│ ┌─────────────────┐ ┌──────────────┐ │
│ │ ENFORCEMENT │ │ LOGGING │ │
│ │ │ │ │ │
│ │ enforcement/ │ │ utils/ │ │
│ │ ─ rule manager │ │ ─ events.csv │ │
│ │ ─ blocked IPs │ │ ─ events.json│ │
│ │ ─ iptables hook │ │ ─ aiaf.log │ │
│ └────────┬────────┘ └──────┬───────┘ │
│ │ │ │
│ └──────────┬─────────┘ │
│ ▼ │
│ ┌───────────────────────┐ │
│ │ WEB DASHBOARD │ │
│ │ │ │
│ │ dashboard/ │ │
│ │ ─ Flask server │ │
│ │ ─ Chart.js live graph │ │
│ │ ─ Blocked IPs table │ │
│ │ ─ Event stream │ │
│ │ ─ Auto-refresh (4s) │ │
│ └───────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
┌──────────────────────────────┐
│ MODELS LAYER │
│ models/ │
│ ─ trained IsolationForest │
│ ─ feature scaler │
│ ─ model persistence (.pkl) │
└──────────────────────────────┘
┌──────────────────────────────┐
│ HONEYPOT (Optional) │
│ honeypot/ │
│ ─ decoy service listener │
│ ─ trap malicious probes │
└──────────────────────────────┘
AIAS/
│
├── main.py # Entry point — train / pcap / live modes
├── traffic_simulator.py # Fake event generator for demo/testing
├── requirements.txt # Python dependencies
│
├── capture/ # Packet capture subsystem
│ └── ... # pcap parsing, live interface capture
│
├── features/ # Feature engineering
│ └── ... # Packet → ML feature vector pipeline
│
├── detection/ # ML anomaly detection
│ └── ... # Isolation Forest model wrapper
│
├── enforcement/ # Rule enforcement engine
│ └── ... # Blocked IP management, iptables bridge
│
├── models/ # Persisted ML model artifacts
│ └── ... # .pkl model files, scalers
│
├── dashboard/ # Flask web dashboard
│ └── ... # Routes, templates, Chart.js frontend
│
├── honeypot/ # Decoy service (optional trap layer)
│ └── ...
│
├── utils/ # Shared utilities
│ └── logger.py # Triple-format event logger
│
├── data/
│ └── raw/
│ └── sample.pcap # Sample capture file for testing
│
├── logs/ # Runtime output (auto-generated)
│ ├── events.csv # Structured event table
│ ├── events.json # Line-by-line JSON log
│ └── aiaf.log # Human-readable log file
│
└── scripts/ # Helper/setup scripts
AIAS uses Isolation Forest, an unsupervised anomaly detection algorithm from scikit-learn, as its core detection engine.
- No labeled data required — learns from normal traffic patterns alone
- Efficient at high dimensions — network traffic has many features
- Fast inference — scores events in microseconds at runtime
- Effective at isolating rare events — anomalies are easier to isolate by random partitioning
Normal Traffic → Score close to 0 → ALLOW
Suspicious Traffic → Score approaching -1 → FLAG / BLOCK
Threshold: configurable contamination factor (default ~5% outliers)
# Train on synthetic baseline data
python main.py --mode train
# Score events from a pcap file (dry run, no enforcement)
python main.py --mode pcap --pcap data/raw/sample.pcap --dry-run
# Live capture from a network interface
sudo python main.py --mode live --iface eth0 --run-seconds 60 --dry-runEvery traffic decision is written to three formats simultaneously via utils/logger.py:
| File | Format | Purpose |
|---|---|---|
logs/events.csv |
Structured CSV | Data analysis, spreadsheet import |
logs/events.json |
Line-by-line JSON | Log aggregators (ELK, Splunk, etc.) |
logs/aiaf.log |
Human-readable | Terminal monitoring, tail -f |
┌────────────┬──────────────┬───────────┬──────────┬───────────────────┐
│ timestamp │ source_ip │ score │ decision │ rule_id │
├────────────┼──────────────┼───────────┼──────────┼───────────────────┤
│ 1726172400 │ 192.168.1.45 │ -0.823 │ BLOCK │ anomaly_threshold │
│ 1726172401 │ 10.0.0.12 │ 0.021 │ ALLOW │ normal_traffic │
│ 1726172402 │ 172.16.5.99 │ -0.991 │ BLOCK │ anomaly_threshold │
└────────────┴──────────────┴───────────┴──────────┴───────────────────┘
The Flask-powered dashboard provides a real-time view of everything AIAS detects.
Features:
- 📈 Live anomaly score graph — rolling 10-minute window via Chart.js
- 🚫 Blocked IPs table — all enforcement decisions in one place
- 📝 Recent events stream — last N events with score and decision
- 🔄 Auto-refresh every 4 seconds — no manual reload needed
Starting the dashboard:
# Dashboard starts automatically with main.py
# Or run standalone:
python dashboard/app.pyThen open: http://localhost:5000
traffic_simulator.py generates randomized fake traffic events for demo and testing purposes — no real network interface or pcap required.
python traffic_simulator.pyThis keeps the dashboard alive and populated during demos, simulating a mix of normal and anomalous events with randomized IPs and scores.
| Requirement | Notes |
|---|---|
| Python 3.10+ | Tested on 3.10, 3.11 |
| Arch Linux / Debian / Ubuntu | Any modern Linux |
| Root access | Required for live capture only |
| pip | Package manager |
git clone https://github.com/0xhroot/AIAS.git
cd AIASpython -m venv venv
source venv/bin/activatepip install -r requirements.txtpython main.py --mode trainThis trains the Isolation Forest on synthetic baseline data and saves the model to models/.
python main.py --mode pcap --pcap data/raw/sample.pcap --dry-runsudo python main.py --mode live --iface eth0 --run-seconds 30 --dry-run# ⚠️ This will apply real iptables rules. Use only in a lab VM.
sudo python main.py --mode live --iface eth0 --run-seconds 60# Terminal 1: Run simulator
python traffic_simulator.py
# Terminal 2: Watch dashboard
python dashboard/app.py
# Open http://localhost:5000
⚠️ Always use--dry-rununtil you are confident in your environment. Test live enforcement only in an isolated lab VM.
| Layer | Technology | Purpose |
|---|---|---|
| Language | Python 3.10+ | Core runtime |
| ML Engine | scikit-learn (Isolation Forest) | Anomaly detection |
| Packet Capture | Scapy / pcap | Network traffic ingestion |
| Feature Engineering | NumPy, Pandas | Packet → vector pipeline |
| Web Dashboard | Flask | Backend API + HTML serving |
| Frontend Charts | Chart.js | Live anomaly visualization |
| Logging | Custom logger | CSV + JSON + plaintext |
| Enforcement | iptables / ufw bridge | Active blocking |
| Persistence | Pickle (.pkl) | Model save/load |
| Shell | Bash scripts | Setup automation |
- Dry-run by default —
--dry-runflag prevents any real iptables modification - Honeypot layer — optional decoy services in
honeypot/to trap active probers - No network egress — AIAS does not phone home or send data externally
- Lab VM recommended — always test live enforcement in an isolated environment before production use
- Root only when necessary — only live capture mode requires elevated privileges
| Feature | Snort/Suricata | pfSense | iptables | AIAS |
|---|---|---|---|---|
| Signature-based | ✅ | ✅ | ✅ | ❌ not needed |
| ML anomaly detection | ❌ | ❌ | ❌ | ✅ |
| Zero-day potential | ❌ | ❌ | ❌ | ✅ |
| Auto-adapting rules | ❌ | ❌ | ❌ | ✅ |
| Live dashboard | ✅ | ❌ | ✅ | |
| No rule DB required | ❌ | ❌ | ❌ | ✅ |
| Lightweight Python | ❌ | ❌ | ✅ | ✅ |
- Deep Packet Inspection — Payload-level feature extraction for richer ML input
- Multi-model ensemble — Combine Isolation Forest + One-Class SVM + Autoencoder
- Online learning — Continuously retrain model on incoming traffic without restart
- Alert webhooks — POST to Slack, Discord, or PagerDuty on high-severity events
- GeoIP tagging — Annotate events with country/ASN data
- Docker container — One-command deploy with all dependencies bundled
- Prometheus metrics — Export anomaly scores as time-series for Grafana
- IPv6 support — Extend capture and enforcement to IPv6 traffic
- CLI TUI — Terminal dashboard using Rich or Textual as dashboard alternative
- pcap export — Save flagged sessions as pcap for forensic review
📅 October 2025
First public release. Includes full ML pipeline, live dashboard, traffic simulator, and enforcement layer.
AIAS is a research and educational project. It is intended for use in isolated lab environments. The author takes no responsibility for misuse, unintended blocking, or network disruption caused by running this tool in production environments. Always test with --dry-run first.
MIT License — Copyright (c) 2025 0xhroot
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies, subject to the MIT license conditions.
