Enterprise-grade continuous trust intelligence and insider threat detection platform
Designed for modern, high-security ecosystems (e.g., Next-Gen Banking, Aerospace)
Instead of relying on static-perimeter security, Astra-Q continuously evaluates behavioral telemetry, dynamically scoring user trust anomalies alongside Post-Quantum Cryptography (PQC) to defend against inside threats and data exfiltration natively.
- Frontend Framework: Next.js 14, React 18
- Styling & UI: Tailwind CSS, Framer Motion, Recharts
- Backend API: FastAPI (Python 3.10+)
- Machine Learning Engine: DGL (GCN), Scikit-Learn (Isolation Forest, Random Forest), PyTorch
- Real-Time Data Ingestion: Apache Kafka, Zookeeper, WebSockets
- Target LLM Model: Groq (Llama-3-8b)
- Cryptographic Primitives:
liboqs-python(ML-KEM / ML-DSA) - Caching & Session Storage: Redis
- Infrastructure: Docker / Docker Compose
Astra-Q employs an ultra-scalable, service-oriented architecture bridging real-time event streaming, Artificial Intelligence, and cryptographic resilience.
- Apache Kafka & Zookeeper: The nervous system of Astra-Q. Raw behavioral telemetry (keystrokes, file access, peripheral devices, login patterns) generated by corporate endpoints is published directly to Kafka topics (e.g.,
aegis.telemetry). - WebSocket Relays: Operating out of the FastAPI backend, active websockets consume these Kafka streams to push zero-latency data directly into the React/Next.js client interface. Analysists watch the ecosystem react dynamically.
To accurately isolate rogue activity without interrupting legitimate employees, Astra-Q deploys an ensemble Machine Learning model called the Fusion Head:
- Heterogeneous Graph Convolutional Network (HeteroGCN): Models the complex interconnected topologies of the company (Users → PCs → Files). An employee accessing a file type previously untouched by their peer-group immediately spikes connection weights.
- Psychometric Normalization: Handles localized temporal shifts. Implements Isolation Forests (for raw outlier detection) and Random Forests (supervised historical pattern classification) to contextualize data based on "time-of-day" behaviors.
- Sequential Transformers: Designed specifically to spot long-form, drawn-out exfiltration methods that evade traditional SIEM log scraping by maintaining state awareness of chronologic sequences.
- Risk Output: These pipelines fuse to classify the user into four dynamic tiers: Low, Medium, High, or Critical.
Astra-Q is built to withstand threats from the impending quantum computing era by implementing Open Quantum Safe (liboqs) Native C bindings wrapped for Python:
- ML-KEM-1024 (Kyber): Utilized for Key Encapsulation Mechanisms (KEM) to facilitate quantum-resistant transport tunnels beyond traditional TLS algorithms.
- ML-DSA-87 (Dilithium): Used as the immutable source of truth. Every mitigation executed and every threat isolated is digitally signed using Dilithium signatures. They are stored securely into the
pqc_keysmodule, generating unbreakable cryptographic audit logs.
- Next.js 14 / React: Executing in a highly-optimized
standaloneDocker architecture. - Aesthetics: Fully shifted to a modern "Light-Paste Mint" enterprise design language focusing on high contrast, readability, and glass-morphic depth modeling.
- Visual Telemetry: The UI binds real-time data to Entity Relationship Graphs identifying threat nodes topologically via colors (Users, PCs, Files).
- Groq SDK AI Assistant: Utilizing Llama3-8b, an integrated Chatbot analyzes logs via natural language processing to assist analysts on-the-fly.
The repository is modularly containerized into distinct core environments:
astra-q/
│
├── frontend/ # Interactive Control Center (Next.js 14)
│ ├── Dockerfile # Multi-stage optimized Docker build for Next.js standalone container
│ ├── .eslintrc.json # ESLint configuration for frontend static typings
│ ├── next.config.js # Next configuration including standalone output for Docker
│ ├── package.json / package-lock.json # Frontend dependency manifest (Tailwind, Framer Motion, Recharts)
│ ├── postcss.config.js / tailwind.config.js # Styling processor and Tailwind component class configurations
│ ├── tsconfig.json # TypeScript compiler parameters
│ ├── next-env.d.ts # Next.js typescript declarations
│ ├── public/ # Static assets served to the client
│ │ ├── astra_logo.jpg # Astra-Q main platform application logo
│ │ └── logo.png # Secondary platform badge graphic
│ └── src/
│ ├── app/ # App router & Page architectures
│ │ ├── globals.css # Master stylesheet declaring Enterprise Light Mint system variables
│ │ ├── layout.tsx # Root layout wrapper binding authentication context to all child routes
│ │ ├── page.tsx # High-fidelity public Landing Page detailing enterprise threat defense
│ │ ├── access/
│ │ │ └── page.tsx # Primary Entry Gateway coordinating login and MFA workflows
│ │ └── dashboard/
│ │ ├── page.tsx # Core Command Center layout managing Telemetry, Control, and Ledger tabs
│ │ └── report/
│ │ └── page.tsx # Granular Threat Report dashboard rendering dynamic entity graphs and mitigations
│ ├── components/
│ │ ├── AccessPortal/
│ │ │ ├── CriticalDenial.tsx # Renders 403 ML-DSA lockdown screen during extreme behavioral anomaly
│ │ │ ├── LoginForm.tsx # Orchestrates base user authentication and password extraction
│ │ │ └── MfaChallenge.tsx # Triggers TOTP secondary authentication when adaptive friction is assigned
│ │ ├── AlertPanel/
│ │ │ └── index.tsx # Right-side heads-up display rendering active temporal threats locally
│ │ ├── ArchitecturalGraph/
│ │ │ └── index.tsx # Visualizes systemic infrastructure via D3 algorithms
│ │ ├── AuditLedger/
│ │ │ └── index.tsx # Displays immutable, cryptographically-signed records of past mitigations
│ │ ├── Chatbot/
│ │ │ └── index.tsx # Draggable LLM overlay analyzing cyber-logs via natural language context
│ │ ├── common/
│ │ │ └── NavSidebar.tsx # Application vertical navigation toolbar orchestrating system routes
│ │ ├── MetricsBar/
│ │ │ └── index.tsx # Dashboard header widgets displaying throughput and active risk aggregators
│ │ ├── SessionManager/
│ │ │ └── index.tsx # Active session visual tracker showcasing online user identities
│ │ ├── ThreatGraph/
│ │ │ └── index.tsx # D3.js powered Force-Directed graph bridging behavioral anomaly clusters
│ │ ├── ThreatTable/
│ │ │ └── index.tsx # Central event tracker allowing analysts to initiate manual containment payloads
│ │ └── WorkflowTracker/
│ │ └── index.tsx # Progressive visual stepper tracking the multi-stage event processing pipeline
│ ├── context/
│ │ └── AuthContext.tsx # React Context mapping identity data across protected routes
│ ├── hooks/
│ │ ├── useMounted.ts # Utility hook ensuring client-side hydration safety
│ │ ├── useThreatData.ts # Polls historical threat sets when WebSockets are unresponsive
│ │ └── useWebSocket.ts # Real-time data pipeline consuming Kafka analytics natively to the UI
│ └── lib/
│ ├── api.ts # Axios interceptors mapping frontend requests to backend core endpoints
│ └── types.ts # Universal TypeScript primitives declaring Data, Model, and Risk structures
│
├── backend/ # FastAPI Application Engine & Kafka Consumers
│ ├── Dockerfile # Backend container incorporating gcc/cmake steps required for liboqs C-bindings
│ ├── .env / .env.example # Security variables provisioning Cryptographic KEKs and Groq keys
│ ├── compile_oqs.py # Automated internal build script enforcing quantum-encryption C libraries
│ ├── main.py # Core FastAPI ASGI app aggregating modular routers and enabling CORS
│ ├── openapi.json # Autogenerated OpenAPI specs mapping the REST endpoints
│ ├── pyproject.toml # Universal Poetry replacement declaring all backend python modules
│ ├── requirements.txt # Deprecated standard python dependency graph list
│ ├── test_login.py / test_pqc.py # Pre-deployment validation scripts validating MFA auth logic and OQS binding stability
│ ├── api/
│ │ ├── main.py # Master API aggregator linking web server middleware to sub-routers
│ │ └── routers/
│ │ ├── auth.py # Identity processor governing session risk assessment against Redis caches
│ │ ├── chat.py # Chatbot handler communicating telemetry inquiries to the Groq LLM API
│ │ ├── system.py # Uptime health checks verifying ML model integration status
│ │ ├── threats.py # Containment endpoint executing policy isolation and firing ML-DSA signatures
│ │ └── ws.py # Asynchronous handler mounting persistent broadcast pipes with active dashboards
│ ├── ingestion/
│ │ ├── cert_reader.py # Parse mechanisms pulling structured raw data frames from local CERT datasets
│ │ ├── feature_cache.py # Redis-backed buffer caching historical user variables supporting fast anomaly clustering
│ │ ├── kafka_producer.py # Translates internal raw dataset structures into asynchronous live Kafka streams
│ │ ├── simulator.py # Script generating synthetic malicious traffic for live demonstration testing
│ │ └── syslog_stream.py # Native handler absorbing external system logs directly into the analytic pipeline
│ ├── llm/
│ │ └── groq_client.py # Integration controller bundling local incident data into API requests for Llama3 analysis
│ ├── models/
│ │ ├── evaluate.py # Post-training logic ensuring predictive Isolation Forest outputs meet minimal thresholds
│ │ ├── process_data.py # Script orchestrating dimensional reduction and categorical encodings on raw logs
│ │ ├── test_models.py # Unit test protocol validating predictive outcomes prior to application integration
│ │ └── train.py # Primary orchestration executing ensemble training iterations across core datasets
│ ├── pqc/
│ │ ├── __init__.py # Marks Cryptographic toolkit space
│ │ ├── audit_log.py # Secure JSON ledger handler caching signed Dilithium transaction hashes
│ │ ├── dsa.py # ML-DSA implementation utilized for issuing unforgeable containment commands
│ │ └── kem.py # ML-KEM module designed to provision symmetric session keys securely resistant to quantum-cracking
│ ├── scripts/
│ │ ├── provision_demo_secrets.py # Seeds identical authentication hashes across Redis and Postgres for uniform demo operations
│ │ └── provision_demo_totp_db.py # Automatically populates mock two-factor authorization codes into the simulation graph
│ ├── tests/
│ │ ├── __init__.py # Initializer identifying PyTest directories
│ │ ├── conftest.py # Injects pre-constructed testing fixtures across testing loops
│ │ └── test_pqc.py # Unit verification directly confirming OQS library encapsulation outputs via liboqs
│ ├── training/
│ │ ├── __init__.py # Training module namespace
│ │ └── train.py # Legacy or alternate training compilation node (often overlaps with models directory)
│ └── utils/
│ ├── __init__.py # Shared utilities namespace
│ ├── keywrap.py # Cryptographic controller handling Fernet-based Key Encryption Keys based off `.env`
│ ├── secret_store.py # Runtime configuration manager pulling validated environment mappings automatically
│ ├── totp_db.py # Secondary mock database logic enforcing accurate 2-factor code comparisons
│ └── vault_client.py # Hypothetical wrapper structure mimicking hashicorp vault secret extraction protocols
│
├── models/ # Root Pre-compiled ML models outputs
│ └── training_report.json # Meta statistical output of final isolation forest training cycles displaying accuracy matrices
│
├── infra/ # Deployment Infrastructure configurations
│ ├── .env / .env.example # Environment parameters establishing global container networking specifics
│ ├── docker-compose.yml # Central nervous orchestration file bootstrapping the frontend, backend, Kafka, and Redis images via docker
│ ├── kafka/
│ │ └── topics.sh # Bash script natively bound to Zookeeper launching fundamental `aegis.telemetry` data topics instantly
│ └── postgres/
│ └── init.sql # SQL initialization generating mock identity user tables when relational databases are utilized
│
└── README.md # You are here - Exhaustive project blueprint and deployment instructions
Follow these steps to deploy Astra-Q locally via Docker Compose.
- Docker Desktop / Docker Compose
- Python 3.10+ (if running natively without Docker)
- Node.js & npm (for frontend modifications)
- A valid Groq API Key for the AI assistant
git clone https://github.com/your-org/astra-q.git
cd astra-qCopy over the environment template and insert your API keys:
cp .env.example .envEnsure you have the following secrets defined in .env:
FERNET_KEY=<generate_base64_32_byte_key>
GROQ_API_KEY=<your_groq_api_key_here>Use Docker Compose to provision the backend, frontend, Zookeeper, Kafka, and Redis instances.
cd infra
docker-compose up --build -dNote: The backend container will compile the liboqs C-library from source during the build phase. This may take a few minutes.
Once the containers report healthy, open your browser and navigate to:
- Analyst Dashboard:
http://localhost:3000 - Backend API Docs (Swagger):
http://localhost:8000/docs
graph TD
%% Entities
User((Endpoint User))
Kafka{{Apache Kafka}}
ML[Fusion Head Engine]
Redis[(Redis Sessions)]
Auth{Risk Assessor}
SOC((Analyst Dashboard))
%% Flows
User -->|Behavioral Telemetry| Kafka
User -->|Access Request| Redis
Redis --> Auth
Kafka -->|Stream Consumption| ML
ML -->|Risk Tier Update| Auth
Auth -->|Low Risk| Allow[Seamless Access]
Auth -->|Temporal Anomaly| MFA[TOTP Challenge Required]
Auth -->|Critical Threat| Deny[Post-Quantum 403 Lockdown]
Deny -->|ML-DSA-87 Signed Audit| SOC
MFA -->|Websocket Alert| SOC
Allow -.->|Normal Operations| SOC
SOC -->|One-Click Mitigation| Deny
- Access Initiation: The operator queries the Astra-Q Gateway via
/api/auth/request-access. - Risk Assessment: The Identity Provider routes the request through a Redis-backed feature cache to analyze the source environment in real time.
- Adaptive Friction:
- If the metrics imply standard operational parameters, passage is granted seamlessly.
- If temporal or location anomalies are detected, the system triggers the MFA Challenge, blocking passage until a secondary cryptographic TOTP token is verified.
- If catastrophic parameters block identity assurance, the system throws a
403 CRITICAL DENIEDresponse, halting the login via automated post-quantum containment logs.
- Continuous Telemetry: Legitimate operator logs are continuously passed into the Kafka broker.
- Behavioral Shift: An employee begins batch downloading highly classified files at 3:00 AM on an unauthorized device. The Fusion Head processes this via the Graph and Transformer modules, instantly shifting the risk tier to
CRITICAL. - Analyst Review: The Dashboard isolates the event in the UI Alert Panel in milliseconds. Real-time Node Graphs color the affected user and endpoint in deep ambers and reds.
- Instant Mitigation: An analyst invokes the Adaptive Privilege Sliders or triggers a direct "Revoke Connection" payload. This request is passed back to the FastAPI
/api/threats/containendpoint, which is instantly evaluated, signed byML-DSA-87, and executed to immediately lock down the network node natively.
Astra-Q represents a paradigm shift against traditional Enterprise Intrusion Systems by enforcing continuous validation alongside algorithmic foresight.
| Feature Area | Astra-Q | Traditional SIEM / IAM |
|---|---|---|
| Identity Paradigm | Continuous Trust Scoring evaluates intent continuously throughout an active session. | Static Perimeter Defense grants unlimited access once a user bypasses the initial password/MFA screen. |
| Cryptography Standard | NIST Post-Quantum Cryptography (ML-KEM / ML-DSA) securing payloads against quantum decryption. | Legacy RSA / ECC protocols, which are fundamentally vulnerable to factorization algorithms (Shor's Algorithm). |
| Architectural Speed | Real-Time Data Streams directly linking Kafka producers to Websocket frontends for instantaneous action. | Batch Log Scraping & Indexing where delays of 10-30 minutes between breach and detection are normal. |
| Mitigation Action | One-Click Micro-segmentation dynamically locks out specific user paths dynamically from the SOC dashboard. | Manual scripting requiring IT ticket handling, leading to response paralysis and broader breaches. |
| Deployment Feasibility | High Feasibility: Modular Docker deployment using Python/Next.js microservices. Lightweight and horizontally scalable via Kubernetes. | Low Flexibility: Heavy monolithic deployment structures requiring immense database replication and rigid configurations. |