How meghanab1909/capstone works
This repository is an IoT security demonstration combining a traffic gateway, anomaly-detection code, configurable honeypots, and monitoring interfaces. The principal workflow is an incoming request reaching the gateway, which classifies benign versus suspicious traffic; suspicious activity can be investigated through honeypot session analysis and surfaced in the dashboard. The tree and excerpts also show Beelzebub’s protocol-based traps and optional LLM integration. Several links between services are not shown in the excerpts, so they are omitted or marked unverified rather than treated as established runtime calls.
Main entry points: protocol_manager.go Protocol Manager · main.go Beelzebub Runtime · hybrid_ai.py Hybrid Classifier · app.py Security Dashboard
Components 25
Traffic Handling
- Traffic Gateway
gateway/gateway.py - Traffic Records
logs/traffic.csv - IoT Device Portal
iot_device/device.py
Detection and Models
- Hybrid Classifier
ai_engine/hybrid_ai.py - Flow Detection
ai_engine/detect.py - Anomaly Evaluation
ai_engine/if_eval.py - Model Training
ai_engine/model_train.py - Forest Training
ai_engine/train_rf.py - Trained Models
ai_engine/models/random_forest.pkl
Honeypot Services
- Beelzebub Runtime
honeypot/beelzebub/main.go - Config Parser
honeypot/beelzebub/parser/configurations_parser.go - Service Builder
honeypot/beelzebub/builder/builder.go - Protocol Manager
honeypot/beelzebub/protocols/protocol_manager.go - HTTP Trap
honeypot/beelzebub/protocols/strategies/HTTP/http.go - SSH Trap
honeypot/beelzebub/protocols/strategies/SSH/ssh.go - TCP Trap
honeypot/beelzebub/protocols/strategies/TCP/tcp.go - MCP Trap
honeypot/beelzebub/protocols/strategies/MCP/mcp.go - Event Tracing
honeypot/beelzebub/tracer/tracer.go - LLM Plugin
honeypot/beelzebub/plugins/llm-integration.go - Cloud Plugin
honeypot/beelzebub/plugins/beelzebub-cloud.go
Analysis and UI
- Honeypot Portal
honeypot/honeypot.py - Session Analyser
honeypot_analyser.py - Honeypot Report
logs/honeypot_report.json - Security Dashboard
dashboard/app.py
Other components
- Network Client
Connections 15
- Network Client → Traffic Gateway: sends requests
- Traffic Gateway → Traffic Records: records flows
- Hybrid Classifier → Traffic Records: reads flows
ai_engine/hybrid_ai.py - Hybrid Classifier → Trained Models: loads model
ai_engine/hybrid_ai.py - Beelzebub Runtime → Config Parser: reads configuration
honeypot/beelzebub/main.go - Beelzebub Runtime → Service Builder: builds services
honeypot/beelzebub/main.go - Protocol Manager → Event Tracing: creates tracer
honeypot/beelzebub/protocols/protocol_manager.go - Protocol Manager → HTTP Trap: initializes strategy
- Protocol Manager → SSH Trap: initializes strategy
- Protocol Manager → TCP Trap: initializes strategy
- Protocol Manager → MCP Trap: initializes strategy
- Security Dashboard → Session Analyser: uses analysis
dashboard/app.py - Security Dashboard → Honeypot Report: reads report
dashboard/app.py - Honeypot Portal → Beelzebub Runtime: inspects runtime
- Session Analyser → Honeypot Report: writes report
honeypot_analyser.py