How safa-prog-hub/agentshield1 works
AgentShield is a Zeek-based network threat detection application. Its live workflow tails Zeek connection logs, normalizes and stores events, then runs model-based and port-scan detection; a parallel SSH-log path identifies brute-force activity. A separate training workflow cleans and balances CIC-IDS2017 CSV data, trains and evaluates a Random Forest, and saves the model used by live inference. The README is empty, and the map relies on the supplied source excerpts; some listed modules were not sampled, so their wiring is omitted.
Main entry points: live_detector.py Live orchestrator · collector_zeek.py Zeek collector · detector.py Model loader · train_model.py Training pipeline
Components 16
Event collection
- Zeek collector
src/collector_zeek.py - Event normalizer
src/normalizer.py - Normalized event stream
Live detection
- Live orchestrator
src/live_detector.py - Model loader
src/detector.py - Feature adapter
src/live_feature_adapter.py - Random Forest
models - Port scan detector
src/behavior_detector.py - Detection results
SSH detection
- SSH log parser
src/ssh_log_parser.py - Brute-force detector
src/ssh_bruteforce_detector.py
Model training
- Training pipeline
src/train_model.py - Trained model artifact
models
Other components
- Zeek logs
- Zeek SSH log
- Training CSV data
Connections 15
- Zeek logs → Zeek collector: provides conn logs
- Zeek collector → Event normalizer: normalizes
- Zeek collector → Normalized event stream: writes events
- Normalized event stream → Live orchestrator: tails events
- Live orchestrator → Model loader: loads model
- Model loader → Random Forest: loads artifact
- Live orchestrator → Feature adapter: builds features via
- Live orchestrator → Port scan detector: checks scan behavior
- Live orchestrator → Detection results: writes results
- Zeek SSH log → Live orchestrator: tails SSH events
- Live orchestrator → SSH log parser: parses SSH lines
- Live orchestrator → Brute-force detector: checks brute force
- Live orchestrator → Detection results: writes SSH alerts
- Training CSV data → Training pipeline: loads CSVs
- Training pipeline → Trained model artifact: saves trained model