ASTRA — Brute-Force Detector

A minimal, runnable prototype that detects brute-force login attacks from log events using machine learning anomaly detection.

Overview

ASTRA uses an IsolationForest model trained on synthetic "normal" network traffic to detect brute-force attacks in real-time. When suspicious activity is detected, it generates human-readable reports and takes simulated defensive actions.

Features

• Real-time anomaly detection using IsolationForest (scikit-learn)
• Flask HTTP server with REST API for event ingestion
• Sliding 60-second window aggregation per source IP
• Automatic report generation (JSON + plain text)
• Configurable thresholds and actions
• Traffic simulator with normal and brute-force modes

Quick Setup

1. Create Virtual Environment

python -m venv venv

Windows (PowerShell/CMD):

venv\Scripts\activate

macOS/Linux:

source venv/bin/activate

2. Install Dependencies

pip install -r requirements.txt

3. Train Models

python model_training.py

This generates:

• models/anomaly_detector.joblib — trained IsolationForest model
• models/scaler.joblib — StandardScaler for feature normalization
• models/feature_columns.joblib — feature column order

4. Start Server

Windows:

set ASTRA_PORT=5000
python astra_server.py

macOS/Linux:

export ASTRA_PORT=5000
python astra_server.py

Server starts on http://0.0.0.0:5000

5. Run Simulator

Normal traffic (should generate few/no alerts):

python send_bruteforce.py --server http://localhost:5000 --mode normal --rate 2 --duration 60

Brute-force attack (should trigger BLOCK_IP action):

python send_bruteforce.py --server http://localhost:5000 --mode bruteforce --rate 3 --duration 60

API Endpoints

POST /ingest

Accepts single event or array of events:

{
  "ts": "2025-10-28T18:00:00Z",
  "src_ip": "192.168.1.10",
  "dst_ip": "10.0.0.5",
  "dst_port": 22,
  "protocol": "TCP",
  "bytes": 1024,
  "event_type": "login_failed"
}

GET /api/reports

Returns list of recent report metadata.

GET /api/state

Returns current in-memory state: blocked IPs, recent anomalies.

How Detection Works

1. Aggregation: Events are aggregated per source IP over a 60-second sliding window
2. Feature Extraction: Computes:
   • failed_login_count — number of failed login attempts
   • conn_count — total connection count
   • unique_dest_ports — number of unique destination ports
   • avg_bytes — average bytes per connection
3. Anomaly Scoring: Features are scaled and passed to IsolationForest model
4. Classification: Flagged as BRUTE_FORCE if:
   • failed_login_count >= 5 AND
   • anomaly_score >= 0.5 (default threshold)
5. Action Decision:
   • Confidence ≥ 0.9 → BLOCK_IP
   • Confidence ≥ 0.6 → QUARANTINE_HOST
   • Otherwise → FLAG_FOR_REVIEW

Viewing Reports

Reports are written to the reports/ directory:

• report_<timestamp>_<rand>.json — structured report
• report_<timestamp>_<rand>.txt — human-readable summary

You can also query via API:

curl http://localhost:5000/api/reports

Tuning Detection

Edit astra_server.py to adjust:

• ANOMALY_THRESHOLD (default: 0.5) — minimum anomaly score
• FAILED_LOGIN_THRESHOLD (default: 5) — minimum failed login count
• CONFIDENCE_BLOCK (default: 0.9) — confidence for IP blocking
• CONFIDENCE_QUARANTINE (default: 0.6) — confidence for quarantine

Troubleshooting

Port Already in Use

Change port via environment variable:

set ASTRA_PORT=8080  # Windows
export ASTRA_PORT=8080  # macOS/Linux

Firewall Issues

Ensure port is open in Windows Firewall or iptables.

Feature Mismatch Errors

Delete models/ directory and retrain:

python model_training.py

Server Can't Find Models

Ensure you run model_training.py before starting the server.

Simulator Connection Refused

• Check server is running: curl http://localhost:5000/api/state
• Verify correct hostname/port in --server argument
• Check firewall rules

Project Structure

astra/
├── astra_server.py          # Flask server (main application)
├── model_training.py        # Model training script
├── send_bruteforce.py       # Traffic simulator
├── requirements.txt         # Python dependencies
├── README.md                # This file
├── models/                  # Generated model artifacts
│   ├── anomaly_detector.joblib
│   ├── scaler.joblib
│   └── feature_columns.joblib
└── reports/                 # Generated detection reports
    ├── report_*.json
    └── report_*.txt

Requirements

• Python 3.10+
• No external cloud services required
• Single-machine deployment

License

MIT