def extract_features(log_entry):
    """Extract security features from log entries"""
    features = {
        'timestamp': log_entry['timestamp'],
        'source_ip': extract_ip(log_entry['message']),
        'user': extract_username(log_entry['message']),
        'action': classify_action(log_entry['message']),
        'severity': log_level_to_severity(log_entry['level']),
        'location': extract_location(log_entry.get('geoip', {})),
        'device_type': detect_device(log_entry.get('user_agent', ''))
    }
    
    # Compute temporal features
    features['hour_of_day'] = features['timestamp'].hour
    features['is_weekend'] = features['timestamp'].weekday() >= 5
    
    return features

def analyze_ssh_attack(log_entries):
    """Use LLM to analyze SSH brute-force attacks"""
    
    # Summarize key information
    summary = summarize_ssh_logs(log_entries)
    
    # Build LLM prompt
    prompt = f"""You are an experienced security analyst. Please analyze the following SSH login events to determine if this is a brute-force attack:

{summary}

Please answer:
1. Confirmed as brute-force attack (yes/no)
2. Attack source IP addresses and count
3. Targeted username list
4. Attack duration (minutes)
5. Severity level (low/medium/high/critical)
6. Recommended actions
7. Any other correlated threats
Return results in JSON format."""
    
    response = call_llm_api(prompt)
    return parse_json_response(response)

#!/bin/bash
# ssh_block.sh

THRESHOLD=5  # Maximum allowed failed attempts

# Get recent failed login records
FAILED_LOGS=$(grep "Failed password" /var/log/auth.log | tail -100 | awk '{print $11}' | sort | uniq -c | sort -nr)

while read count ip; do
    if [ $count -gt $THRESHOLD ]; then
        echo "Brute-force detected: $IP count=$count, blocking..."
        
        # Add to hosts.deny
        echo "$IP : ALL" >> /etc/hosts.deny
        
        # Or use iptables to block
        iptables -A INPUT -s $ip -j DROP
        
        # Send alert
        send_alert "SSH brute-force blocked: $IP (failures: $count)"
        
        # Optionally restart SSH service to change port
        systemctl restart ssh
    fi
done <<< "$FAILED_LOGS"

def analyze_web_logs(nginx_logs):
    """Analyze Nginx access logs for web attacks"""
    
    suspicious_patterns = [
        r'.*\/.*\.php\?.*=.*system.*',      # PHP command injection
        r'.*select\s+.*from.*union.*',      # SQL injection
        r'.*<script>',                      # XSS
        r'.*etc/passwd',                   # Path traversal
        r'.*\\.\\.',                        # Directory traversal
    ]
    
    analysis = {
        'total_requests': len(nginx_logs),
        'suspicious_requests': [],
        'attack_sources': {},
        'most_common_attack': None
    }
    
    for log in nginx_logs:
        for pattern in suspicious_patterns:
            if re.search(pattern, log.get('uri', ''), re.IGNORECASE):
                analysis['suspicious_requests'].append({
                    'ip': log.get('ip'),
                    'uri': log.get('uri'),
                    'pattern': pattern,
                    'timestamp': log.get('timestamp')
                })
                
                # Track attacker sources
                ip = log.get('ip')
                analysis['attack_sources'][ip] = analysis['attack_sources'].get(ip, 0) + 1
    
    # Find most common attack type
    if analysis['suspicious_requests']:
        most_common = max(set(p['pattern'] for p in analysis['suspicious_requests']), 
                          key=lambda p: sum(1 for r in analysis['suspicious_requests'] if r['pattern'] == p))
        analysis['most_common_attack'] = most_common
    
    return analysis

def llm_web_analysis(log_entry):
    """Use LLM for complex web request analysis"""
    
    prompt = f"""You are a web security expert. Please analyze the following HTTP request for security risks:

Method: {log_entry['method']}
URL: {log_entry['url']}
User-Agent: {log_entry.get('user_agent', 'N/A')}
Referer: {log_entry.get('referer', 'N/A')}
Parameters: {log_entry.get('params', '{}')}

Please answer:
1. Security threat exists (yes/no)
2. Threat type (SQL-injection/XSS/command-injection/other)
3. Severity level (low/medium/high)
4. Detailed description and recommended actions
Return results in JSON format."""
    
    response = call_llm_api(prompt)
    return parse_json_response(response)

class InternalThreatMonitor:
    def __init__(self, baseline_db):
        self.baseline = baseline_db  # Store normal behavior baselines
        self.alert_threshold = 3  # Threshold for triggering alerts
    
    def check_process_creation(self, event):
        """Detect suspicious process creation"""
        suspicious_executables = [
            '/bin/netcat', '/curl', '/socat', '/base64', '/openssl',
            '/tmp/', '/dev/shm/'
        ]
        
        for exe in suspicious_executables:
            if exe in event['executable']:
                self.increment_suspicion(event['user'], event['process_id'])
                return True
        
        return False
    
    def check_file_access(self, event):
        """Detect sensitive file access"""
        sensitive_files = [
            '/etc/passwd', '/etc/shadow', '/root/.ssh/id*', 
            '~/.config/docker/config.json', '.env', '.aws/'
        ]
        
        for sfile in sensitive_files:
            if sfile in event['file_path']:
                self.increment_suspicion(event['user'], event['process_id'])
                return True
        
        return False
    
    def increment_suspicion(self, user, pid):
        """Increase suspicion counter and possibly trigger alert"""
        key = f"{user}:{pid}"
        self.suspicion_counts[key] = self.suspicion_counts.get(key, 0) + 1
        
        if self.suspicion_counts[key] >= self.alert_threshold:
            self.generate_threat_alert(user, pid)
            self.suspicion_counts[key] = 0  # Reset counter
    
    def generate_threat_alert(self, user, pid):
        """Generate threat alert"""
        alert = {
            'type': 'internal_threat',
            'user': user,
            'process_id': pid,
            'suspicion_count': self.suspicion_counts[pid],
            'timestamp': datetime.now().isoformat(),
            'recommendation': f"Investigate user {user}'s process {pid}, consider resetting credentials"
        }
        send_security_alert(alert)
        notify_admin(alert)

def analyze_user_behavior(log_entries, user_context):
    """Comprehensively analyze user behavior patterns using LLM"""
    
    # Aggregate recent user behavior
    behavior_summary = aggregate_user_behavior(log_entries)
    
    prompt = f"""You are a security operations expert. Please analyze the following user behavior patterns to identify anomalies or potential threats:

User: {user_context['username']}
Role: {user_context['role']}
Normal Activity Hours: {user_context['normal_hours']}
Typical Login Locations: {user_context['normal_locations']}

Recent Activity Summary:
{behavior_summary}

Specific questions:
1. Current behavior differs significantly from historical patterns (yes/no)
2. If differences exist, specifically where (time/location/device/action type)
3. Risk level assessment (low/medium/high)
4. Recommend temporary account lockout or MFA requirement
5. Detailed investigation steps and evidence collection procedures
Return results in JSON format."""
    
    analysis = call_llm_api(prompt)
    return analysis

def block_ip(ip_address, duration_minutes=60):
    """Block malicious IP address"""
    
    # Check if already blocked
    if is_blocked(ip_address):
        return False
    
    # Add firewall rule
    try:
        if use_fail2ban():
            subprocess.run(['fail2ban-client', 'set', 'sshd', 'banip', ip_address])
        elif use_ufw():
            subprocess.run(['ufw', 'deny', 'from', ip_address])
        elif use_iptables():
            subprocess.run(['iptables', '-A', 'INPUT', '-s', ip_address, '-j', 'DROP'])
        
        # Record operation
        audit_log(action='block_ip', target=ip_address, initiated_by='AI_Security_System')
        
        # Schedule automatic unblock (if needed)
        schedule_unblock(ip_address, duration_minutes)
        
        return True
    except Exception as e:
        log_error(f"Failed to block IP {ip_address}: {e}")
        return False

def terminate_suspicious_process(pid, process_name):
    """Terminate suspicious process"""
    
    # Try SIGTERM first, then SIGKILL
    try:
        os.kill(pid, signal.SIGTERM)
        time.sleep(2)
        
        # Check if process still alive
        if psutil.pid_exists(pid):
            os.kill(pid, signal.SIGKILL)
        
        # Collect process context for forensics
        process_info = get_process_context(pid)
        save_evidence(pid, process_info)
        
        audit_log(action='terminate_process', pid=pid, name=process_name, initiated_by='AI_Security_System')
        
        return True
    except ProcessLookupError:
        return False
    except PermissionError:
        return False

def isolate_docker_container(container_name):
    """Isolate infected Docker container"""
    
    client = docker.from_env()
    
    try:
        container = client.containers.get(container_name)
        
        # Stop container network access
        container.update(network_mode="none")
        
        # Create snapshot for forensic preservation
        snapshot_tag = f"{container_name}-snapshot-{int(time.time())}"
        container.commit(snapshot=snapshot_tag)
        
        # Record image digest for later analysis
        image_digest = container.image.digest()
        save_incident_evidence(container_name, image_digest)
        
        # Send alert
        send_alert(f"Container {container_name} isolated, please investigate")
        
        audit_log(action='isolate_container', container=container_name, initiated_by='AI_Security_System')
        
        return True
    except docker.errors.NotFound:
        return False

# security-config.yaml
system:
  enabled: true
  auto_scale: true
  log_retention_days: 30

llm_client:
  provider: qwen
  base_url: https://dashscope.aliyuncs.com/api/v1/services/aigc/text-generation/geminal-chat
  api_key: ${DASHSCOPE_API_KEY}
  model: qwen-max
  
  # Optimization strategies
  caching_enabled: true
  cache_max_size: 1000
  max_calls_per_hour: 1000

detection_rules:
  ssh_failed_attempts: 5
  ssh_window_seconds: 60
  web_suspicious_requests: 10
  window_minutes: 5

response_policies:
  level_1:  # P1 Critical
    actions: ['block_ip', 'terminate_process', 'isolate_container']
    require_approval: false
    notify_channels: ['slack', 'email', 'sms']
  
  level_2:  # P2 High
    actions: ['block_ip', 'alert_admin']
    require_approval: false
    notify_channels: ['slack', 'email']
  
  level_3:  # P3 Medium
    actions: ['log_event', 'monitor_more']
    require_approval: true
    notify_channels: ['slack']
  
  level_4:  # P4 Low
    actions: ['log_only']
    require_approval: true
    notify_channels: []

safety_rules:
  max_concurrent_operations: 3
  cooldown_period: 300
  maintenance_windows:
    - '02:00-06:00'  # Maintenance window, no high-risk auto-operations
  protected_ips:
    - '192.168.1.0/24'
    - 'your-office-ip'

sudo apt update
sudo apt install -y python3-pip docker.io
pip3 install requests docker python-multipart pyyaml
sudo systemctl enable --now docker

# Create systemd service unit
sudo vim /etc/systemd/system/ai-security-monitor.service

[Unit]
Description=AI Security Monitoring Service
After=network.target docker.service

[Service]
Type=simple
User=root
WorkingDirectory=/opt/ai-security
ExecStart=/usr/bin/python3 /opt/ai-security/security_monitor.py
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable ai-security-monitor
sudo systemctl start ai-security-monitor

# /etc/environment or ~/.bashcase export DASHSCOPE_API_KEY=your-api-keyexport OPENAI_API_KEY=optional-api-key

# init_db.py
import sqlite3

conn = sqlite3.connect('/var/lib/ai-security/events.db')
cursor = conn.cursor()

cursor.execute('''
CREATE TABLE IF NOT EXISTS events (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
    event_type TEXT,
    severity TEXT,
    source_ip TEXT,
    description TEXT,
    analyzed BOOLEAN DEFAULT 0,
    action_taken TEXT
)
''')

cursor.execute('''
CREATE INDEX IF NOT EXISTS idx_timestamp ON events(timestamp)
''')

cursor.execute('''
CREATE INDEX IF NOT EXISTS idx_severity ON events(severity)
''')

conn.commit()
conn.close()

SYSTEM_PROMPTS = {
    "ssh_audit": """You are a senior SSH security analyst. Please analyze the following SSH login attempts:
- Distinguish legitimate logins from brute-force attempts
- Identify anomalous login times and locations
- Assess account compromise risk
- Provide specific hardening recommendations
Return JSON output: {threat_score: number, is_brute_force: bool, recommended_actions: []}""",
    
    "web_request": """You are a web security expert. Please analyze the following HTTP request:
- Detect SQL injection, XSS, command injection, and common web attacks
- Assess request danger level
- If malicious, classify and provide mitigation steps
Return JSON output: {is_malicious: bool, threat_type: string, severity: string, mitigation_steps: []}""",
    
    "incident_report": """You are an incident responder. Based on the following event information:
- Summarize what happened
- Determine impact scope and damage
- Propose immediate containment measures and long-term improvements
- Write a concise report suitable for executive review""",
    
    "forensics_analysis": """You are a digital forensics expert. Please analyze the following system state:
- Identify potential persistence mechanisms
- Locate hidden malicious files or backdoors
- Assess attacker privilege levels
- Recommend evidence collection and eradication steps""",
}

import time
from functools import lru_cache
import hashlib
import base64
import requests

class SecureLLMClient:
    def __init__(self, api_key, base_url, max_retries=3):
        self.api_key = api_key
        self.base_url = base_url
        self.max_retries = max_retries
        self.call_history = []
        self.call_rate_limit = 10  # Max calls per second
        self.last_call_time = 0
    
    @lru_cache(maxsize=500)
    def cached_analysis(self, prompt_hash, system_prompt, user_prompt):
        """Cache identical prompt responses to avoid redundant calls"""
        return self._call_api(system_prompt, user_prompt)
    
    def rate_limit(self):
        """Implement rate limiting to prevent API quota exceeded"""
        elapsed = time.time() - self.last_call_time
        if elapsed < (1 / self.call_rate_limit):
            time.sleep((1 / self.call_rate_limit) - elapsed)
        self.last_call_time = time.time()
    
    def _call_api(self, system_prompt, user_prompt):
        """Safe API call with retry mechanism"""
        for attempt in range(self.max_retries):
            try:
                self.rate_limit()
                
                payload = {
                    "model": "qwen-max",
                    "messages": [
                        {"role": "system", "content": system_prompt},
                        {"role": "user", "content": user_prompt}
                    ],
                    "timeout": 30
                }
                
                response = requests.post(
                    f"{self.base_url}/chat/completions",
                    json=payload,
                    headers={"Authorization": f"Bearer {self.api_key}"},
                    timeout=30
                )
                
                result = response.json()
                
                # Record call history (masked)
                self.call_history.append({
                    'timestamp': time.time(),
                    'success': response.status_code == 200
                })
                
                if len(self.call_history) > 1000:
                    self.call_history.pop(0)
                
                return result
                
            except (requests.RequestException, TimeoutError) as e:
                if attempt == self.max_retries - 1:
                    raise
                time.sleep(2 ** attempt)  # Exponential backoff
    
    def monitor_api_usage(self):
        """Monitor API usage to prevent cost overruns"""
        total_calls = len([c for c in self.call_history if c['success']])
        hourly_cost = total_calls * 0.0002  # Assume $0.0002 per call
        
        if hourly_cost > 10.0:  # Over $10/hour
            self.disable_auto_responses()
            send_critical_alert("API cost threshold exceeded, auto-responses disabled automatically")
        
        return total_calls, hourly_cost
    
    def disable_auto_responses(self):
        """Disable auto-response functions, keep only alerts"""
        print("⚠️ Auto-response functions disabled - contact administrator")
    
    def sign_record(self, record):
        """Digitally sign audit records for integrity verification"""
        # Implementation...
        pass

# safety-security-rules.yaml
safety_rules:
  max_concurrent_operations: 3  # Max simultaneous security operations
  cooldown_period: 300  # Minimum 300-second interval between operations
  maintenance_windows:
    - '02:00-06:00'    # Maintenance windows (no auto-operations)
    - '12:00-13:30'    # Lunch break periods
  
  require_approval_for:
    - "delete_operations"
    - "configuration_changes"
    - "production_service_restart"
    - "database_modification"
  
  allowlist:
    trusted_ips:
      - '192.168.1.0/24'
      - 'office.ip.address'
      - 'backup.server.ip'
    
    allowed_processes:
      - "/usr/sbin/sshd"
      - "/usr/bin/docker"
      - "/usr/bin/systemctl"
      - "/usr/bin/apt"
  
  rollback_strategy:
    enabled: true
    auto_rollback_on_failure: true
    backup_before_change: true
    snapshot_timeout: 300
  
  monitoring:
    track_all_actions: true
    alert_on_unusual_patterns: true
    daily_summary_report: true
    
    # Special attention triggers
    anomaly_triggers:
      - concurrent_operations > 3
      - operation_frequency > 10_per_minute
      - operation_during_maintenance_window
      - multiple_failed_attempts_same_hour

class AuditLogger:
    def __init__(self, log_path='/var/log/ai-security-audit.log'):
        self.log_path = log_path
        self.signer = load_signing_key()  # Private key for signing
    
    def log(self, action, target=None, details=None, initiated_by='system'):
        """Record security operation audit log"""
        record = {
            'timestamp': datetime.now().isoformat(),
            'action': action,
            'target': target,
            'details': details or {},
            'initiated_by': initiated_by,
            'ip': get_request_ip() if from_http else None
        }
        
        # Digitally sign record for integrity
        record_str = json.dumps(record, sort_keys=True).encode()
        signature = sign_record(record_str, self.signer)
        record['signature'] = base64.b64encode(signature).decode()
        
        # Write to log file
        with open(self.log_path, 'a') as f:
            f.write(json.dumps(record) + '\n')
        
        # Sync to SIEM system (optional)
        send_to_siem(record)
    
    def verify_signature(self, record):
        """Verify audit record integrity"""
        # Verification implementation...
        pass

def collect_feedback(from_alert, analyst_decision):
    """Collect security analyst feedback for model training"""
    
    feedback_record = {
        'alert_id': alert.id,
        'threat_type': alert.threat_type,
        'llm_prediction': llm_prediction,
        'analyst_decision': analyst_decision,  # 'true_positive' / 'false_positive' / 'ignored'
        'feedback_comments': comments,
        'timestamp': datetime.now().isoformat()
    }
    
    # Save to feedback database
    db.save(feedback_record)
    
    # Retrain anomaly detection model periodically
    if feedback_count_since_last_train > 100:
        retrain_anomaly_model(feedback_records)
        clear_cached_models()  # Invalidate old model caches
    
    return feedback_record

def update_threat_intelligence():
    """Regularly update threat intelligence knowledge base"""
    
    # Fetch latest threat indicators from external feeds
    indicators = fetch_threat_intelligence_feeds([
        'aliensware', 'virus_total', 'custom_internal_feeds'
    ])
    
    # Organize and classify using LLM
    prompt = f"""Organize the following threat intelligence indicators, grouped by category, with confidence score and priority for each indicator:

{indicators}

Output format: YAML dictionary with categories, indicators, confidence, priority fields"""
    
    organized = call_llm_api(prompt)
    
    # Update local knowledge base
    threat_knowledgebase.update(organized)
    
    # Reload detection rules
    reload_detection_rules()