A real-time cybersecurity monitoring system for detecting DDoS attacks and network anomalies using machine learning, FastAPI, and an interactive PyQt5 dashboard.
CyberGuardian is a Python-based cybersecurity application designed to monitor network traffic, detect Distributed Denial-of-Service (DDoS) attacks, identify network anomalies, and provide real-time security insights through an interactive dashboard.
The project combines FastAPI, PyQt5, Machine Learning, SQLite SIEM logging, and WebSockets to create a complete network defense and monitoring solution.
- 📡 Real-time network traffic monitoring
- 🚨 DDoS attack detection
- 🤖 Machine Learning-based anomaly detection
- 📊 Live risk score visualization
- 🖥️ Interactive PyQt5 dashboard
- 📑 SIEM event logging
- 🔄 WebSocket live updates
- 🔍 Packet analysis and anomaly monitoring
- 🚧 Automatic IP quarantine
- 👤 Manual threat review system
- ✅ IP Whitelisting & Blacklisting
- 📁 Export alerts to CSV
- 📈 Security analytics dashboard
- ⚡ Built-in DDoS attack simulator
| Technology | Purpose |
|---|---|
| Python | Programming Language |
| FastAPI | Backend API |
| PyQt5 | Desktop GUI |
| SQLite | SIEM Database |
| Pandas | Data Processing |
| NumPy | Numerical Computing |
| Scikit-learn | Machine Learning |
| Isolation Forest | Anomaly Detection |
| Matplotlib | Data Visualization |
| WebSockets | Live Communication |
| Scapy | Packet Analysis |
| Uvicorn | ASGI Server |
CyberGuardian/
│
├── defender.py # Main CyberGuardian Application
├── attacker.py # DDoS Attack Simulator
├── requirements.txt
├── README.md
├── cyberguardian.log
├── attack_simulation.log
└── siem_logs.db
- Python 3.7+
- PyQt5
- FastAPI
- Pandas
- NumPy
- Scikit-learn
- Scapy
- Matplotlib
- WebSockets
- Uvicorn
Install all dependencies using:
pip install -r requirements.txtgit clone https://github.com/your-username/CyberGuardian.gitcd CyberGuardianpip install -r requirements.txtpython defender.pyEnter the IP address to monitor when prompted.
Open another terminal.
python attacker.pyType:
stop
to stop the simulated attack.
The main dashboard provides:
- Live network alerts
- Real-time risk scores
- Attack statistics
- Average risk score
- Attack rate
- Alert feed
- Network anomaly monitor
- Alert export
- Attack filtering
The SIEM dashboard displays:
- Security events
- Detected attacks
- Quarantined devices
- Event history
- Most active IP address
- Response actions
| Risk Score | Action |
|---|---|
| 0 – 50 | Safe (Automatically Cleared) |
| 51 – 80 | Manual Review Required |
| 81 – 100 | Automatically Quarantined |
You can customize CyberGuardian by modifying the following variables:
WHITELIST
BLACKLIST
REQUEST_THRESHOLD
PACKET_SIZE_THRESHOLDCyberGuardian supports exporting:
- Security Alerts (.csv)
- Network Anomalies (.csv)
🎥 YouTube Video
- Email Notifications
- Docker Support
- Cloud Deployment
- Deep Learning Detection Models
- Multi-device Monitoring
- Authentication & User Roles
- Threat Intelligence Integration
- Grafana Dashboard
Contributions are welcome!
- Fork the repository
- Create a feature branch
git checkout -b feature-name- Commit your changes
git commit -m "Added new feature"- Push your branch
git push origin feature-name- Open a Pull Request
This project is intended only for educational, research, and defensive cybersecurity purposes.
The authors are not responsible for any misuse, unauthorized testing, or damages caused by this software.
If you found this project useful, consider giving it a ⭐ on GitHub!