All Features
Everything AISS
does for you.
12 detection and response modules working in parallel — 24/7, fully autonomous, zero configuration required after setup.
25+
Threat Types
12
Detection Modules
< 1s
Detection Speed
100%
Cross-Platform
Network Intrusion Detection
Detects port scans, DDoS attacks, MITM, ARP spoofing, C2 traffic, DNS hijacking, DNS tunneling, lateral movement, and data exfiltration — in real-time across Windows and Linux.
- Port scan detection (SYN, stealth, full connect)
- C2 beacon & callback traffic analysis
- ARP spoofing & MITM detection
- DNS hijacking via baseline comparison
- Data exfiltration volume monitoring
Authentication Attack Detection
Monitors Windows Event Logs and Linux auth files for every type of authentication-based attack pattern including impossible travel detection.
- Brute force & credential stuffing
- Password spray detection
- Privilege escalation alerts
- Impossible travel (same user, 2 IPs < 5 min)
- Session anomaly & unusual-hour login detection
File System & Ransomware Detection
Watches temp directories, downloads, and system folders for malicious scripts, ransomware extension patterns, and file hash matching against known threat intel.
- Ransomware extension pattern matching
- Malicious script detection (.ps1, .vbs, .bat)
- SHA-256 hash comparison against threat intel
- Mass file modification rate monitoring
- Suspicious file creation alerts
Malware & Process Analysis
Scans running processes and memory for 25+ malware types including cryptominers, keyloggers, rootkits, trojans, botnets, and fileless malware.
- XMRig & cryptominer process detection
- Keylogger behavioral signatures
- Rootkit & hidden process scanning
- Botnet C2 communication patterns
- Fileless malware via memory inspection
Claude AI Threat Analysis
Every detected threat is analyzed by Claude AI which provides MITRE ATT&CK mapping, IOC extraction, step-by-step response plans, and severity assessment automatically.
- MITRE ATT&CK tactic & technique mapping
- IOC (Indicator of Compromise) extraction
- Expert response plan generation
- False positive reasoning
- Threat correlation across events
Automated Threat Response
When a threat is confirmed, AISS acts immediately — no human required. Blocks, kills, quarantines, and flushes DNS across Windows and Linux.
- IP blocking via Windows Firewall / iptables
- Malicious process termination (taskkill / kill)
- File quarantine to isolated directory
- DNS cache flushing
- Admin alert broadcast via WebSocket
Honeypot & Deception Layer
Deploys fake credentials, API keys, and admin panels as traps. Any access to these honeypots instantly triggers a CRITICAL alert with the attacker's IP and behaviour.
- Fake admin panel at /admin route
- Rotating honeypot credentials & API keys
- Fake AWS/Stripe keys as bait
- Instant CRITICAL alert on any access
- Attacker IP + behaviour logging
USB & Removable Media Monitoring
Detects when USB drives and removable media are connected. Scans them automatically for malware, suspicious scripts, and autorun threats.
- Real-time USB insertion detection
- Auto-scan on connect
- Malicious autorun.inf detection
- Removable media malware scanning
- Cross-platform Windows & Linux support
MITRE Kill Chain Mapping
Maps every detected threat to the Lockheed Martin Cyber Kill Chain and MITRE ATT&CK framework, showing exactly which stage of an attack is in progress.
- 7-stage kill chain visualization
- MITRE ATT&CK tactic mapping
- Real-time stage progression tracking
- Per-threat kill chain breakdown
- Attack pattern correlation
AI SOC Chat Assistant
An always-available AI security analyst you can ask anything — CVE lookups, mitigation strategies, threat explanations, and incident response guidance.
- Natural language threat Q&A
- CVE lookup & explanation
- Mitigation step recommendations
- False positive analysis
- Incident response guidance
Keyword & Pattern Self-Learning
AISS learns new threat patterns from cybersecurity video transcripts and research, continuously expanding its detection vocabulary without retraining.
- Video transcript analysis for new threats
- Dynamic keyword threat vocabulary
- Auto-expanding malware name database
- Suspicious port pattern learning
- Zero-config continuous improvement
Production-Grade Backend
Built with FastAPI, SQLAlchemy async ORM, JWT authentication, rate limiting, WebSocket real-time feed, and SQLite/PostgreSQL support — ready for production.
- FastAPI + SQLAlchemy async ORM
- JWT access + refresh tokens
- Role-based access (admin / analyst / viewer)
- WebSocket real-time threat broadcast
- SQLite (dev) or PostgreSQL (prod)
Ready to deploy AISS?
One command. All 12 modules active. Works on Windows and Linux.