# Install ntopng
sudo apt update
sudo apt install ntopng redis-server -y

# Configure ntopng
sudo tee /etc/ntopng/ntopng.conf <<'EOF'
--interface=eth0
--http-port=3000
--redis-server=localhost
--capture-bpf="not port 3000 and not port 6379"
--flow-sampling-rate=100
EOF

sudo systemctl enable ntopng
sudo systemctl start ntopng

# Create Prometheus configuration
mkdir -p /etc/prometheus
cat > /etc/prometheus/prometheus.yml <<'EOF'
global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: 'node'
    static_configs:
      - targets: ['localhost:9100']

  - job_name: 'ntopng'
    static_configs:
      - targets: ['localhost:9100']
EOF

# Install Node Exporter
wget https://github.com/prometheus/node_exporter/releases/download/v1.8.2/node_exporter-1.8.2.linux-amd64.tar.gz
tar xzf node_exporter-*.tar.gz
sudo cp node_exporter-*/node_exporter /usr/local/bin/
sudo systemctl enable node_exporter
sudo systemctl start node_exporter

# Install InfluxDB 2.x
wget -q https://www.influxdata.com/install-influxdb.sh -O /tmp/influxdb.sh
bash /tmp/influxdb.sh

# Create database and bucket
influx bucket create --name vps_traffic --retention 30d

# Telegraf configuration
cat > /etc/telegraf/telegraf.conf <<'EOF'
[[outputs.influxdb_v2]]
  urls = ["http://localhost:8086"]
  token = "${INFLUX_TOKEN}"
  organization = "selfvps"
  bucket = "vps_traffic"

[[inputs.net]]
  per_interface = true

[[inputs.nstat]]

[[inputs.system]]
  metric_batch_size = 1000
EOF

sudo systemctl enable telegraf
sudo systemctl start telegraf

curl -fsSL https://ollama.com/install.sh | sh

# Pull Qwen2.5-7B model (suitable for VPS environments)
ollama pull qwen2.5:7b

# Verify installation
ollama list
ollama run qwen2.5:7b "Hello, introduce yourself in one sentence."

#!/usr/bin/env python3
"""AI-powered VPS traffic analyzer using local LLM."""

import json
import subprocess
from datetime import datetime, timedelta
from pathlib import Path

OLLAMA_URL = "http://localhost:11434"
MODEL = "qwen2.5:7b"
INFLUXDB_URL = "http://localhost:8086"
INFLUX_TOKEN = Path("/root/.influxdb_token").read_text().strip()
ORG = "selfvps"
BUCKET = "vps_traffic"

def query_traffic_history(hours=24):
    """Query traffic data from InfluxDB for the last N hours."""
    now = datetime.utcnow()
    since = (now - timedelta(hours=hours)).isoformat() + "Z"

    query = f'''
from(bucket: "{BUCKET}")
  |> range(start: {since})
  |> filter(fn: (r) => r["_measurement"] == "net")
  |> filter(fn: (r) => r["_field"] == "bytes_recv" or r["_field"] == "bytes_sent")
  |> group(columns: ["host", "interface"])
  |> sum()
'''
    result = subprocess.run(
        ["influx", "query", query, "--org", ORG, "--token", INFLUX_TOKEN, "-i"],
        capture_output=True, text=True
    )
    return result.stdout

def analyze_with_llm(traffic_data, context=""):
    """Use LLM to analyze traffic data and return a structured report."""
    prompt = f"""You are a professional VPS operations engineer and network analyst. Please analyze the following traffic data and provide a report.

## Current Traffic Summary (past 24 hours)
{traffic_data}

## System Context
{context}

Please output the analysis report in the following JSON format:
{{
  "health_status": "normal|warning|critical",
  "anomalies": [
    {{
      "type": "traffic_spike|unusual_outbound|port_scan|data_exfiltration",
      "description": "Description of anomaly",
      "severity": "low|medium|high",
      "evidence": "Supporting evidence"
    }}
  ],
  "optimization_suggestions": [
    {{
      "action": "Specific action",
      "estimated_savings": "Estimated savings percentage",
      "risk_level": "low|medium|high",
      "implementation": "Implementation steps"
    }}
  ],
  "summary": "Overall assessment summary (under 50 characters)"
}}"""

    import requests
    response = requests.post(
        f"{OLLAMA_URL}/api/generate",
        json={
            "model": MODEL,
            "prompt": prompt,
            "stream": False,
            "options": {
                "temperature": 0.3,
                "num_predict": 2048
            }
        }
    )
    return response.json()

def main():
    print(f"[{datetime.now()}] Starting traffic analysis...")

    # 1. Query traffic data
    traffic_data = query_traffic_history(24)
    print(f"Traffic data: {traffic_data[:200]}...")

    # 2. Get system context
    context = f"""
    - System load: {subprocess.run(['uptime'], capture_output=True, text=True).stdout.strip()}
    - Memory usage: {subprocess.run(['free', '-h'], capture_output=True, text=True).stdout.strip()}
    - Disk usage: {subprocess.run(['df', '-h'], capture_output=True, text=True).stdout.strip()}
    - Active connections: {subprocess.run(['ss', '-s'], capture_output=True, text=True).stdout.strip()}
    """

    # 3. LLM analysis
    result = analyze_with_llm(traffic_data, context)

    # 4. Parse and output report
    if "response" in result:
        analysis = json.loads(result["response"])
        print("\n" + "="*50)
        print("AI Traffic Analysis Report")
        print("="*50)
        print(f"Health Status: {analysis['health_status']}")
        print(f"Anomalies Found: {len(analysis['anomalies'])}")
        for a in analysis['anomalies']:
            print(f"  [{a['severity']}] {a['type']}: {a['description']}")
        print(f"\nOptimization Suggestions: {len(analysis['optimization_suggestions'])}")
        for s in analysis['optimization_suggestions']:
            print(f"  - {s['action']} (est. savings {s['estimated_savings']}, risk: {s['risk_level']})")
        print(f"\nSummary: {analysis['summary']}")

if __name__ == "__main__":
    main()

# Run traffic analysis every 6 hours
crontab -e

import asyncio
import aiohttp

TELEGRAM_BOT_TOKEN = "YOUR_BOT_TOKEN"
TELEGRAM_CHAT_ID = "YOUR_CHAT_ID"

async def send_telegram_alert(message: str, severity: str = "info"):
    """Send Telegram alert message."""
    emoji = {"critical": "🔴", "warning": "🟡", "info": "ℹ️"}.get(severity, "ℹ️")

    url = f"https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage"
    payload = {
        "chat_id": TELEGRAM_CHAT_ID,
        "text": f"{emoji} **VPS Traffic Anomaly Alert**\n\n{message}",
        "parse_mode": "Markdown",
        "disable_web_page_preview": True
    }

    async with aiohttp.ClientSession() as session:
        async with session.post(url, json=payload) as resp:
            return await resp.json()

# Grafana provisioning config
cat > /etc/grafana/provisioning/dashboards/traffic.json <<'EOF'
{
  "dashboard": {
    "title": "VPS Intelligent Traffic Analysis",
    "panels": [
      {
        "title": "Real-time Bandwidth Usage",
        "type": "timeseries",
        "targets": [
          {"expr": "rate(net_bytes_recv[5m])", "legendFormat": "Received"},
          {"expr": "rate(net_bytes_sent[5m])", "legendFormat": "Sent"}
        ]
      },
      {
        "title": "AI Analysis Results",
        "type": "text",
        "options": { "mode": "markdown" }
      }
    ]
  },
  "overwrite": true
}
EOF

def generate_optimization_actions(analysis):
    """Generate executable optimization actions based on AI analysis results."""
    actions = []

    for suggestion in analysis.get("optimization_suggestions", []):
        action = {
            "name": suggestion["action"],
            "commands": [],
            "rollback": []
        }

        if "compress" in suggestion["action"].lower() or "gzip" in suggestion.get("action", "").lower():
            action["commands"].append("sudo nginx -s reload  # Enable gzip compression")
            action["rollback"].append("sudo sed -i 's/gzip on/gzip off/' /etc/nginx/nginx.conf && sudo nginx -s reload")

        elif "rate limit" in suggestion["action"].lower() or "限速" in suggestion["action"]:
            action["commands"].append(f"sudo tc qdisc add dev eth0 root tbf rate {suggestion.get('rate', '100mbit')} burst 256kbit latency 400ms")
            action["rollback"].append("sudo tc qdisc del dev eth0 root tbf")

        elif "block" in suggestion["action"].lower() or "防火墙" in suggestion["action"]:
            action["commands"].append(f"sudo ufw deny from {suggestion.get('source_ip', '0.0.0.0')}")
            action["rollback"].append(f"sudo ufw delete deny from {suggestion.get('source_ip', '0.0.0.0')}")

        actions.append(action)

    return actions

#!/bin/bash
# Intelligent traffic shaping script
# Driven by AI analysis results, automatically applies optimization policies

set -euo pipefail

LOG_FILE="/var/log/vps-traffic-shaping.log"
BACKUP_DIR="/root/backups/traffic-rules"

mkdir -p "$BACKUP_DIR"

# Backup current rules
tc qdisc show dev eth0 > "$BACKUP_DIR/$(date +%Y%m%d_%H%M%S)_before.txt" 2>&1 || true

# Apply AI-recommended rate limiting (triggered when bandwidth exceeds threshold)
THRESHOLD_MBPS=50
CURRENT_MBPS=$(cat /proc/net/dev | grep eth0 | awk '{printf "%.0f", ($10 / 1048576) * 8 / 5}')

if [ "$CURRENT_MBPS" -gt "$THRESHOLD_MBPS" ]; then
    echo "[$(date)] Traffic ${CURRENT_MBPS}Mbps exceeds threshold, applying shaping policy" >> "$LOG_FILE"
    tc qdisc add dev eth0 root handle 1: htb default 10
    tc class add dev eth0 parent 1: classid 1:10 htb rate ${THRESHOLD}mbit ceil ${THRESHOLD}mbit
    echo "[$(date)] Traffic shaping policy applied" >> "$LOG_FILE"
else
    echo "[$(date)] Traffic normal (${CURRENT_MBPS}Mbps), no shaping needed" >> "$LOG_FILE"
fi

async def auto_block_malicious_ips(anomaly_list):
    """Automatically block high-malice-likelihood IPs."""
    blocked = []
    for anomaly in anomaly_list:
        if anomaly["severity"] in ["high", "critical"]:
            # Extract malicious IP from evidence
            ip = extract_ip(anomaly["evidence"])
            if ip and not is_whitelisted(ip):
                subprocess.run(["sudo", "ufw", "deny", "from", ip], check=False)
                blocked.append(ip)
                await send_telegram_alert(
                    f"🔴 Auto-blocked malicious IP: {ip}\nReason: {anomaly['description']}",
                    "critical"
                )
    return blocked

# docker-compose.yml
version: '3.8'

services:
  # Traffic collector
  ntopng:
    image: ntop/ntopng:latest
    container_name: ntopng
    ports:
      - "3000:3000"
    volumes:
      - ntopng_data:/var/lib/ntopng
      - ./ntopng.conf:/etc/ntopng/ntopng.conf
    cap_add:
      - NET_ADMIN
      - NET_RAW
    networks:
      - monitoring

  # Metrics storage
  influxdb:
    image: influxdb:2-alpine
    container_name: influxdb
    ports:
      - "8086:8086"
    volumes:
      - influxdb_data:/var/lib/influxdb2
    environment:
      - DOCKER_INFLUXDB_INIT_MODE=setup
      - DOCKER_INFLUXDB_INIT_USERNAME=admin
      - DOCKER_INFLUXDB_INIT_PASSWORD=${INFLUX_PASSWORD}
      - DOCKER_INFLUXDB_INIT_ORG=selfvps
      - DOCKER_INFLUXDB_INIT_BUCKET=vps_traffic
    networks:
      - monitoring

  # Metrics collector
  telegraf:
    image: telegraf:1.30-alpine
    container_name: telegraf
    volumes:
      - ./telegraf.conf:/etc/telegraf/telegraf.conf:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    privileged: true
    networks:
      - monitoring

  # Visualization
  grafana:
    image: grafana/grafana:10.4
    container_name: grafana
    ports:
      - "3001:3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./dashboards:/etc/grafana/provisioning/dashboards
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
    networks:
      - monitoring

  # Local LLM
  ollama:
    image: ollama/ollama:latest
    container_name: ollama
    ports:
      - "11434:11434"
    volumes:
      - ollama_data:/root/.ollama
    networks:
      - monitoring

  # AI analysis service
  traffic-analyzer:
    build: ./analyzer
    container_name: traffic-analyzer
    volumes:
      - ./analyzer:/app
      - /var/log:/host/log:ro
    environment:
      - OLLAMA_URL=http://ollama:11434
      - INFLUXDB_URL=http://influxdb:8086
      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
      - TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID}
    depends_on:
      - ollama
      - influxdb
    networks:
      - monitoring

volumes:
  ntopng_data:
  influxdb_data:
  grafana_data:
  ollama_data:

networks:
  monitoring:
    driver: bridge