Autonomous Cyber Defense AI System

Python • Multi-Agent Architecture • scikit-learn • NetworkX • MITRE ATT&CK • SQLite • psutil

▪ Architected a graph-based multi-agent AI security platform combining rule-based detection, ML anomaly detection (Isolation Forest), and NetworkX attack-path graph analysis — covering prevention, detection, and automated response across all layers.

▪ Built a layered risk fusion engine with adaptive weight learning from persistent attack memory — system automatically escalates: MONITOR → BLOCK_IP → BLOCK_NETWORK based on real-time risk scores and historical pattern analysis.

▪ Upgraded to real-time monitoring engine using psutil: polls Windows Event Log (EventIDs 4625/4624/4672/4688), Linux auth.log, live system processes, and active network connections every 5 seconds continuously.

▪ Process monitor detects suspicious process names, CPU spikes, malicious parent-child chains (e.g. Word → cmd.exe), and processes executing from temp directories — all without any human input.

▪ Network monitor detects high-risk port usage (Metasploit/4444, Tor/9050, backdoors), new listening services, connection bursts, and C2 beaconing patterns in real time.

▪ Generates colored terminal alerts + saves all detections to persistent JSON memory with time-based decay — system distinguishes recent threats from historical ones to avoid over-alerting.