Intelligent network reconnaissance combining async port scanning, CVE correlation, ensemble machine learning for zero-day detection, and a conversational AI security analyst.
NetSentinel AI goes beyond traditional port scanning. It automatically scans a target, correlates open services with known CVEs, runs every result through an ensemble of machine learning models trained on 148,000+ network records to flag suspicious zero-day-style anomalies, and uses an AI agent to generate a full natural-language threat report — including an interactive chat for asking follow-up questions about the findings.
Built as a portfolio project to demonstrate practical, blue-team focused security engineering skills: from low-level async networking to ML model training to full-stack web development.
- 🔍 Async Port Scanner — fast TCP scanning with Quick / Standard / Full profiles
- 🏷️ Service & Banner Detection — fingerprints services and grabs version banners
- 🔗 CVE Correlation — maps detected services to known vulnerabilities via local CVE mapping + NVD API
- 🧠 Ensemble ML Threat Detection — Random Forest, XGBoost, and Isolation Forest models vote together to flag known attacks and zero-day-style anomalies
- 🤖 AI Threat Analyst — generates a full natural-language risk assessment, attack vectors, and remediation steps per scan
- 💬 Conversational AI Chat — ask the AI agent direct questions about any scan's findings
- 📊 Live Dashboard — military-themed dark UI with real-time scan progress, port-level results, and risk badges
- 📋 Scan History & Threat Feed — every scan logged with a live feed of detected threats and a running CVE database
- 📄 PDF Report Generation — professional, downloadable threat assessment report per scan
- 🔐 Authentication — session-based login with bcrypt password hashing
Trained on 148,517 records from the NSL-KDD dataset across 41 network traffic features:
| Model | Role | Accuracy |
|---|---|---|
| Random Forest | Known attack classification | 99.58% |
| XGBoost | CVE severity / threat prediction | 99.43% |
| Isolation Forest | Zero-day anomaly detection | 87.53% |
| Ensemble Vote | Combined final verdict | 99.48% |
Every open port is scored by all three models. A majority vote determines the final verdict, and a flag where Isolation Forest detects an anomaly that the supervised models don't recognize is treated as a possible zero-day indicator — the same anomaly-based principle used by enterprise tools like Darktrace.
Backend: Python · Flask · Flask-Login · SQLAlchemy Scanning: asyncio · socket Machine Learning: Scikit-learn · XGBoost · Pandas · NumPy AI Agent: Groq API (Llama 3.3 70B) Vulnerability Data: NVD API + local CVE mapping Database: SQLite Reporting: ReportLab (PDF generation) Frontend: HTML / CSS / JavaScript — custom dark military terminal UI
(Add your dashboard, scan results, and PDF report screenshots here)
# Clone the repository
git clone https://github.com/MalikTaha8331/NetSentinel-AI.git
cd NetSentinel-AI
# Install dependencies
pip install -r requirements.txt
# Create a .env file with your API key
echo "GROQ_API_KEY=your_key_here" > .env
# Download training datasets
python download_datasets.py
# Train the ML models (one-time setup)
python train_model.py
# Run the application
python run.pyVisit http://localhost:5000, register an account, and start scanning.
NetSentinel-AI/
├── app/
│ ├── auth/ # Login, registration, session management
│ ├── scanner/ # Port scanning engine, CVE correlation, ML engine
│ ├── ai/ # AI threat analysis & chat assistant
│ ├── reports/ # PDF report generation
│ ├── static/
│ └── templates/ # Dashboard UI
├── database/ # SQLite (gitignored)
├── models/ # Trained ML models (gitignored)
├── datasets/ # Training data (gitignored)
├── exports/ # Generated PDF reports (gitignored)
├── config.py
├── run.py
└── requirements.txt
⚠️ Note: Only scan hosts you own or have explicit permission to test. Unauthorized scanning may violate the law in your jurisdiction.
- Expand ML training with CICIDS2017 / UNSW-NB15 for broader attack coverage
- UDP scanning support
- Scheduled/recurring scans
- Multi-host batch scanning
- Asset inventory dashboard
Taha Malik BS Cybersecurity Student — Sir Syed CASE Institute of Technology LinkedIn · GitHub
This project is licensed under the MIT License.