Cyber-Defense-Shield v1.5

Multi-Layered Security Tool for Linux Systems

⚠️ This is a complementary hardening + monitoring toolkit, not a replacement for a WAF, EDR, antivirus, or a dedicated IDS/IPS (Suricata, OSSEC, etc.). Its detection is lightweight and heuristic-based - see Limitations for exactly what it does and does not do before relying on it for anything critical.

Overview

Cyber-Defense-Shield is a practical, multi-layered defense tool for Linux systems. It combines firewall management, system hardening, and lightweight detection - DDoS/DoS mitigation, intrusion detection, basic malware/rootkit indicators, and web attack log scanning - into a single command-line tool with an optional background daemon. See Limitations below for what it deliberately does not try to be.

Key Features

🔍 Security Scanning

• Full System Security Scan: Comprehensive security assessment of entire system
• Open Port Detection: Identify all exposed ports and services
• Suspicious Process Monitoring: Detect malicious or unauthorized processes
• SSH Security Verification: Validate SSH configuration security
• Package Analysis: Scan installed packages for vulnerabilities
• File Integrity Checking: Monitor critical system files for changes

🌐 Network Protection

• Real-time Network Monitoring: Continuous network activity analysis
• Connection Tracking: Monitor and log all network connections
• Traffic Analysis: Connection-level traffic inspection (via ss/netstat - not packet-level DPI)
• Suspicious IP Detection: Identify and log malicious IP addresses
• Protocol Analysis: Connection state and port-level analysis
• Bandwidth Monitoring: Track network usage patterns

🚨 DDoS/DoS Protection

• Rate Limiting: Per-source-IP connection rate limiting (iptables hashlimit)
• SYN Flood Protection: SYN cookies + backlog tuning
• UDP Flood Protection: Protect against UDP-based attacks
• ICMP Flood Protection: Block ICMP echo request floods
• Anti-Spoofing Protection: Kernel-level reverse-path filtering
• Traffic Anomaly Detection: Identify unusual traffic patterns

🔥 Firewall Management

• UFW Firewall Control: Enable and configure firewall rules
• Security Rule Implementation: Apply best-practice security rules
• Port Management: Close dangerous ports, open safe ports
• Incoming Traffic Monitoring: Log and monitor all inbound traffic
• Outgoing Traffic Control: Manage and restrict outbound connections
• Rule Persistence: Save firewall rules permanently

🔐 System Hardening

• SSH Configuration Hardening: Disable root login, password auth
• System Package Updates: Keep all packages current
• Service Hardening: Disable unnecessary services
• Sudo Configuration: Strengthen privilege escalation controls
• Audit Logging: Enable comprehensive system auditing
• Kernel Parameter Tuning: Optimize security-related kernel settings

🎯 Threat Detection

• Log Analysis: Analyze authentication and system logs
• Failed Login Tracking: Monitor failed login attempts
• Attack Pattern Recognition: Identify known attack signatures
• Real-time Monitoring: Continuous threat detection
• Behavioral Analysis: Detect anomalous system behavior
• Alert Generation: Immediate notification of threats

📊 Advanced Features

• HTML Report Generation: Styled, readable HTML security reports
• Threat Severity Classification: Rate threat severity levels
• Recommendations Engine: Provide actionable security recommendations
• Multi-layered Defense: Network, protocol, system, and application levels

🕳️ Persistence & Backdoor Scanning (new in v1.5)

• Cron Persistence Scan: sweeps /etc/crontab, /etc/cron.d, anacrontab and per-user crontabs for reverse shells, pipe-to-shell downloads, base64-decoded payloads and miners
• systemd Unit Scan: flags ExecStart commands matching attack patterns or running binaries from /tmp, /dev/shm, /var/tmp
• Shell Startup Scan: checks root and user .bashrc/.profile/.bash_profile for injected commands
• Detects only - removal of persistence entries stays a manual incident-response decision

⬆️ Privilege-Escalation Surface Audit (new in v1.5)

• SUID/SGID Enumeration: full-filesystem walk with timeout + standard-directory fallback, risk-classified (world-writable SUID = hard alert, unusual SUID = review)
• UID-0 Account Check: flags non-root accounts with root-equivalent UIDs
• Empty-Password Detection: flags accounts whose /etc/shadow hash field is empty (passwordless login)
• NOPASSWD sudo Review: lists passwordless sudo rules from /etc/sudoers and /etc/sudoers.d

🧬 Live-Malware Indicators (new in v1.5)

• Suspicious-Path Processes: flags processes executing from /tmp, /dev/shm or /var/tmp via /proc//exe
• Deleted-Binary Detection: flags processes whose executable was unlinked after launch (a common malware hiding technique)

System Requirements

Minimum Requirements

• OS: Kali Linux / Debian-based Linux
• Python: 3.8 or higher
• RAM: 512 MB
• Disk Space: 100 MB
• Privileges: Root/sudo access required

Recommended Requirements

• OS: Kali Linux 2023+
• Python: 3.10+
• RAM: 2 GB+
• Disk Space: 500 MB+
• Network: Active internet connection for updates

Required Tools

• ss - Socket statistics
• netstat - Network statistics
• iptables - Firewall rules
• sysctl - Kernel parameters
• ufw - Uncomplicated Firewall
• auditctl - Audit framework
• grep - Text search
• ps - Process status
• dpkg - Package management

Installation

Step 1: Clone Repository

git clone https://github.com/cyberrage-ananymus/Cyber-Defense-Shield.git cd Cyber-Defense-Shield

Step 2: Install Dependencies

sudo pip3 install -r requirements.txt

Step 3: Verify Installation

sudo python3 main.py --version

Step 4: Run the Tool

sudo python3 main.py

Usage

Basic Execution

sudo python3 main.py

Menu System

After running the tool, you'll see the main menu with 18 options:

MAIN MENU - Select an Option

1. Full System Security Scan
2. Network Monitoring & Analysis
3. DDoS/DoS Protection & Mitigation
4. Firewall Management & Configuration
5. System Hardening & Security Enhancement
6. Log Analysis & Threat Detection
7. Real-time Threat Detection & Prevention
8. Generate Security Report (Basic)
9. Vulnerability Scanner
10. Intrusion Detection System (IDS)
11. Malware Detection & Analysis
12. User Activity Auditing & Monitoring
13. Advanced Comprehensive Report
14. Run All Security Checks (Full Assessment)
15. Web Attack Scan (SQLi / XSS / Path Traversal)
16. Persistence & Backdoor Scan (cron/systemd/rc)
17. Privilege Escalation Audit (SUID/UID-0/NOPASSWD)
18. Exit Program

Option 1: Full System Security Scan

Performs a comprehensive security assessment:

Select: 1

• Scans all open ports
• Checks for suspicious processes
• Analyzes firewall status
• Verifies SSH security
• Scans installed packages

Option 2: Network Monitoring

Monitors network activity in real-time:

Select: 2

• Displays active connections
• Shows established connections
• Detects suspicious IPs
• Analyzes traffic patterns

Option 3: DDoS/DoS Protection

Activates DDoS protection mechanisms:

Select: 3

• Enables rate limiting
• Activates SYN flood protection
• Enables UDP flood protection
• Monitors for anomalies

Option 4: Firewall Management

Configures and manages firewall:

Select: 4

• Enables UFW firewall
• Applies security rules
• Closes dangerous ports
• Enables traffic monitoring

Option 5: System Hardening

Hardens system security configuration:

Select: 5

• Hardens SSH configuration
• Updates system packages
• Disables unnecessary services
• Configures sudo properly
• Enables audit logging

Option 6: Log Analysis

Analyzes system logs for threats:

Select: 6

• Analyzes authentication logs
• Analyzes system logs
• Detects attack patterns
• Reports findings

Option 7: Real-time Detection

Enables real-time threat monitoring:

Select: 7

• Monitors processes continuously
• Monitors network traffic
• Monitors file system
• Press Ctrl+C to stop

Option 8: Generate Report

Creates detailed security report:

Select: 8

• Collects system data
• Analyzes threats
• Generates HTML report
• Saves to /tmp/cyber_defense_report_*.html

Option 9: Exit

Exits the program:

Select: 9

Daemon Mode & Alerts

By default, Cyber-Defense-Shield only runs when you're sitting at the interactive menu. For continuous protection on a live server, run it as a background daemon instead:

sudo python3 main.py --daemon sudo python3 main.py --daemon --interval 60 # custom interval in seconds

What daemon mode does, on a loop:

• IDS checks (port scans, SYN floods, brute-force attempts)
• Suspicious source IP detection
• Suspicious process detection
• Suspicious file scanning

What daemon mode deliberately does NOT do: re-apply firewall rules, SSH/sudo hardening, or apt-get upgrade automatically each cycle. Those are mutating changes and stay under manual control via the interactive menu - a monitoring loop silently reconfiguring your system on a timer is a different, much riskier feature than a monitoring loop that just watches and alerts.

Previewing changes with --dry-run

Every state-changing action available from the interactive menu - firewall rules, SSH/sudo hardening, sysctls, service disabling, apt-get upgrade - can be previewed instead of applied:

sudo python3 main.py --dry-run

Detection and reporting run completely normally under --dry-run; only the mutating operations are simulated. Each one prints exactly what it would have run (or, for SSH/sudo hardening, validates the proposed config against a temporary file with sshd -t/visudo -c and tells you whether it would pass, without ever touching the real files). Nothing under --dry-run restarts a service, writes to /etc, or changes a sysctl. Combine with --daemon if you want to test a fresh deployment end-to-end before trusting it with real changes.

Running as a systemd service

A ready-to-use unit file is included: cyber-defense-shield.service.

sudo cp cyber-defense-shield.service /etc/systemd/system/ sudo systemctl daemon-reload sudo systemctl enable --now cyber-defense-shield sudo systemctl status cyber-defense-shield journalctl -u cyber-defense-shield -f

Edit the WorkingDirectory and ExecStart paths in the unit file first if you didn't install to /opt/Cyber-Defense-Shield.

Telegram / Discord Alerts

Daemon mode can push findings to Telegram and/or Discord instead of only logging locally. Both are optional and off by default.

Recommended (keeps credentials out of the public repo): set these as environment variables wherever the daemon actually runs - e.g. in cyber-defense-shield.service (see the commented Environment= lines already in that file):

export CDS_TELEGRAM_BOT_TOKEN="your-bot-token-from-BotFather" export CDS_TELEGRAM_CHAT_ID="your-chat-id" export CDS_DISCORD_WEBHOOK_URL="https://discord.com/api/webhooks/..."

Then flip 'enabled': True for whichever channel(s) you're using in config.py:

TELEGRAM_CONFIG = { 'enabled': True, # bot_token/chat_id are read from env vars above ... }

DISCORD_CONFIG = { 'enabled': True, # webhook_url is read from the env var above ... }

Do not paste a real bot token or webhook URL directly into config.py if this repo (or your fork) is public - anyone who reads the file would have your credentials.

To get a Telegram chat_id: message your bot once, then visit https://api.telegram.org/bot<your-bot-token>/getUpdates and read the chat.id field from the response.

If neither is enabled, daemon mode still runs fine - it just logs to the console/LOG_FILE without pushing anywhere.

Configuration

Editing Configuration

Edit config.py to customize settings:

Firewall settings

FIREWALL_ENABLED = True FIREWALL_TYPE = "UFW"

DDoS protection

DDOS_PROTECTION_ENABLED = True RATE_LIMIT_PER_MINUTE = 25

SSH configuration

SSH_PORT = 22 PERMIT_ROOT_LOGIN = False

Dangerous ports to block

DANGEROUS_PORTS = [21, 23, 69, 135, 139, 445, ...]

Allowlist for Option 1's running-service check (empty = list-only, no flagging)

EXPECTED_SERVICES = ['ssh', 'cron', 'rsyslog', 'ufw']

Email alerts (optional)

EMAIL_CONFIG = { 'enabled': False, 'smtp_server': 'smtp.gmail.com', ... }

Daemon mode interval (seconds)

DAEMON_SCAN_INTERVAL_SECONDS = 300

Minimum time between Telegram/Discord pushes (findings still logged every cycle)

ALERT_COOLDOWN_SECONDS = 300

Tuning Detection Thresholds

Every detection threshold in this tool is a tradeoff. Set it too low and you get false positives that can disrupt legitimate traffic on a live system - sometimes worse than the attack you were defending against. Set it too high and real attacks slip through unnoticed. There is no universal default that is correct for every deployment: a quiet personal server and a busy production host need different numbers.

As of v1.2, rate limiting is enforced per source IP rather than as one shared global bucket, and IDS checks (port scan, SYN flood, brute force) are grouped per source IP or a recent time window instead of a single unscoped counter. This removes the worst false-positive cases, but the numeric thresholds below still need to match your own traffic:

DDoS protection - per-source rate limiting

RATE_LIMIT_PER_MINUTE = 25 RATE_LIMIT_BURST = 100 RATE_LIMITED_PORTS = [80, 443]

Intrusion detection - grouped per source IP / time window

SYN_RECV_PER_SOURCE_THRESHOLD = 30 PORT_SCAN_DISTINCT_PORTS_THRESHOLD = 15 BRUTE_FORCE_WINDOW_MINUTES = 10 BRUTE_FORCE_ATTEMPTS_THRESHOLD = 8 SUSPICIOUS_IP_CONNECTION_THRESHOLD = 20

Before trusting any of these for an automated response, watch how the tool behaves against your own normal traffic for a while. If you see alerts that don't match real attack activity, raise the relevant threshold; if you suspect attacks are going unreported, lower it and cross-check against your actual logs.

Project Structure

Cyber-Defense-Shield/ ├── main.py # Main application entry point ├── defense_modules.py # Core security modules ├── config.py # Configuration settings ├── requirements.txt # Python dependencies ├── cyber-defense-shield.service # systemd unit for --daemon mode ├── tests/ │ └── test_defense_modules.py # Core logic tests (unittest, stdlib only) ├── README.md # This file └── .gitignore # Git ignore file

Module Descriptions

main.py

Main application controller with user interface, menu system, and daemon mode.

Classes:

• CyberDefenseShield: Main application class

Functions:

• print_banner(): Display application banner
• print_menu(): Display menu options
• check_root(): Verify root privileges
• check_dependencies(): Report which required system tools (ufw, iptables, auditctl, etc.) are missing, without blocking startup
• run(): Main interactive program loop
• run_daemon(): Continuous background loop (detection + alerts only), used by --daemon
• parse_args(): Parses --daemon / --interval CLI flags

defense_modules.py

Core security modules implementing protection mechanisms.

Classes:

• SecurityScanner: System security scanning
• NetworkMonitor: Network monitoring and analysis
• DDosProtector: DDoS/DoS protection (rate limiting, SYN/UDP/ICMP flood, anti-spoofing)
• FirewallManager: Firewall configuration
• SystemHardener: System security hardening (SSH, sudo, services, syscall-level audit rules)
• LogAnalyzer: Log analysis, attack pattern detection, syscall audit event queries
• RealtimeThreatDetector: Tight-loop monitoring (suspicious IPs, ARP spoofing) for Option 7
• ReportGenerator: Report generation, pulls in all v1.4+v1.5 checks (rootkit/kernel/ARP/services/persistence/privesc)
• VulnerabilityScanner: Known vulnerability / outdated package checks
• IntrusionDetectionSystem: Per-source IDS (port scan, SYN flood, brute force, ARP spoofing/MITM, malware-port connections)
• MalwareDetector: Suspicious file/process detection, kernel module analysis, basic rootkit indicators, real rkhunter integration if installed, suspicious-path/deleted-binary process detection
• UserActivityAuditor: Login and privilege escalation auditing, critical-file permission checks
• AdvancedReporter: Comprehensive HTML reporting (data-driven from live check results)
• AlertNotifier: Sends findings to Telegram/Discord (used by --daemon)
• WebAttackScanner: SQLi/XSS/path-traversal/command-injection signature scan against web server access logs (Option 15)
• PersistenceScanner: Backdoor sweep of cron/systemd/shell-rc persistence locations (Option 16)
• PrivilegeEscalationAuditor: SUID/SGID risk classification, UID-0 accounts, empty passwords, NOPASSWD sudo (Option 17)

config.py

Configuration settings for all protection mechanisms.

Settings:

• Firewall configuration
• DDoS protection parameters
• SSH security settings
• Network security options
• System hardening options
• Attack pattern signatures
• Alert thresholds
• Daemon mode interval
• Telegram / Discord alert credentials
• Compliance settings

Threat Protection Capabilities

DDoS/DoS Attacks

• SYN Flood Protection
• UDP Flood Protection
• ICMP Flood Protection (Option 3)
• Rate Limiting (per-source IP)
• Traffic Analysis

Network Attacks

• Port Scanning Detection
• Suspicious Connection Detection
• IP Spoofing Protection (kernel reverse-path filtering, Option 3)
• ARP Spoofing / Man-in-the-Middle Detection (Option 10 - basic, single-snapshot ARP table check)

Application Attacks

• SQL Injection Detection (access log signature scan, Option 15)
• XSS Attack Detection (access log signature scan, Option 15)
• Path Traversal Detection (access log signature scan, Option 15)
• Command Injection Detection (access log signature scan, Option 15)

Malware & Backdoors

• Suspicious Process Detection
• Basic Rootkit Indicators (Option 11 - process-count discrepancy + known-path check; not a substitute for rkhunter/chkrootkit)
• Kernel Module Analysis (Option 11 - flags modules loaded but missing from disk)
• System Call Monitoring (Option 5 enables; Option 6 queries - real auditd syscall rules on execve/connect)

Unauthorized Access

• Failed Login Monitoring
• Brute Force Attack Detection (time-windowed)
• Running Service Review (Option 1 - allowlist-based if you populate EXPECTED_SERVICES in config.py)
• Privilege Escalation Detection

On honesty about scope: every item above now has real code behind it (no more capabilities that were just text in this README). That said, several are intentionally lightweight heuristics, not replacements for dedicated tools - the docstring on each method in defense_modules.py says plainly what it does and does not catch. Rootkit/kernel-module checks in particular are a basic first-pass signal, not equivalent to rkhunter, chkrootkit, or a real EDR.

Security Best Practices

1. Regular Updates

   • Keep system packages updated
   • Update security tools regularly

2. Monitoring

   • Regularly review logs
   • Monitor network traffic
   • Check firewall rules

3. Hardening

   • Follow CIS Benchmarks
   • Disable unnecessary services
   • Use strong authentication

4. Backup

   • Regular system backups
   • Test backup restoration
   • Keep backup copies secure

5. Incident Response

   • Have incident response plan
   • Document security events
   • Investigate threats thoroughly

Troubleshooting

Permission Denied Error

Solution: Run with sudo sudo python3 main.py

Module Not Found Error

Solution: Install dependencies sudo pip3 install -r requirements.txt

Firewall Not Working

Solution: Install UFW sudo apt-get install ufw

Enable UFW sudo ufw enable

SSH Configuration Error

Solution: Check SSH config sudo nano /etc/ssh/sshd_config

Restart SSH service sudo systemctl restart ssh

Performance Considerations

• Interactive menu scans (Options 1-16): on-demand, one-shot subprocess calls (ss, ps, grep, etc.) - generally sub-second, negligible impact.
• Daemon mode (--daemon): runs a small check cycle once per interval (5 min default, configurable via --interval or DAEMON_SCAN_INTERVAL_SECONDS). Fully idle (zero CPU) between cycles.
• Most daemon checks (connection state, ARP table, suspicious IPs) read kernel tables directly - fast regardless of server load.
• The Web Attack Scan (Option 15 / daemon) tails access logs incrementally - cost scales with new traffic since the last check, not total log size.
• None of this sits inline in the request path. It's a periodic background checker, not a WAF/IPS/proxy, so it cannot add latency to real traffic.
• No built-in benchmarking exists yet - the above is based on what each check actually does, not measured numbers under production load. If you run it on a busy server, real numbers would be genuinely useful feedback.

Limitations

This tool does what's described above and nothing more. Specifically, it does not:

• Perform deep packet inspection or payload-level packet capture (no scapy/DPI - detection is connection/log/signature-based)
• Automatically block or respond to a detected threat (detection and mitigation are separate; nothing here auto-bans an IP because the IDS flagged it)
• Replace a real WAF, IDS/IPS (Suricata/Snort), or EDR - the web attack scanner is signature-based log scanning, not inline traffic filtering
• Replace dedicated rootkit scanners (rkhunter, chkrootkit) - the built-in checks are basic heuristics (process-count mismatch, known paths, kernel module vs. on-disk comparison), not a full rootkit database
• Detect zero-day exploits, novel attack patterns, or anything outside its hardcoded/configured signatures
• Protect against insider threats, physical access, or supply-chain compromise
• Work out of the box on non-Debian/Kali systems (assumes ufw, iptables, ss, dpkg, auditctl are present)
• Guarantee CIS Benchmark or any other compliance framework (the COMPLIANCE config flag is not currently backed by real checks - see Roadmap)

General notes that apply regardless of tooling:

• No tool provides 100% protection against all attacks
• Regular updates and manual log review are still recommended
• Requires correct configuration (thresholds, EXPECTED_SERVICES, etc.) for the checks to be meaningful on your specific system

Legal Disclaimer

This tool is designed for defensive cybersecurity purposes only on systems you own or have explicit permission to test.

Unauthorized access to computer systems is illegal. Users are solely responsible for:

• Compliance with all applicable laws and regulations
• Obtaining proper authorization before testing
• Responsible and ethical use of the tool
• Consequences of misuse

Testing

A basic test suite covers the core detection/parsing logic (web attack scanning + incremental log tailing, ARP spoofing detection, kernel module comparison, config validation, --dry-run's command interception) using only the standard library's unittest/unittest.mock - no test dependency to install, no root or real system tools required to run:

python3 -m unittest tests.test_defense_modules -v

This is not full coverage of every method (many wrap subprocess calls to system tools in ways that are more meaningfully tested by hand on a real Kali/Debian box), but it does cover the pieces where a wrong result matters most and where pure logic can be tested in isolation.

Contributing

Contributions are welcome! Please ensure:

• Code follows Python best practices
• All functions are properly documented
• Security is prioritized
• Testing is performed before submission
• Changes are backwards compatible

Bug Reports

Found a bug? Please report it:

1. Check existing issues
2. Provide detailed description
3. Include steps to reproduce
4. Attach relevant logs

Support

For support and questions:

• Open GitHub Issues
• Contact via Session Messenger: 05fd51ac639edc257133f9364529eff3af1d69c5c18b31f321ba466b3823a0a805
• Join the Discord community: https://discord.gg/9KhfPTqTg
• Connect on LinkedIn: https://www.linkedin.com/in/cyber-rage-green-eyes-801656416

Changelog

v1.5 (2026)

• Fixed the most serious bug in the tool: SSH hardening could be silently ineffective. OpenSSH uses the FIRST value obtained for each keyword, but the hardening block was appended to the END of sshd_config - so any earlier PermitRootLogin yes / PasswordAuthentication yes (extremely common via cloud-init drop-ins in /etc/ssh/sshd_config.d/, whose Include line sits at the top of sshd_config on Debian/Kali) silently overrode the hardened values. sshd -t passes (it validates syntax, not effective values), so everything looked successful while the system stayed insecure. Now: conflicting active directives (main file AND Include'd drop-ins) are commented out first with per-file backups, and the EFFECTIVE config is verified via sshd -T (the daemon's own merged view) before success is claimed - with full rollback if any enforced value did not take effect. "Port" is deliberately not managed (overwriting a user's nonstandard SSH port is a lockout risk), and the deprecated "Protocol 2" line was dropped from the block
• Fixed the same first-match/include blindness in check_ssh_security: it read only the main sshd_config, so a hardened main file overridden by a permissive drop-in was reported as SECURE while sshd was actually accepting passwords. Detection now resolves directives with real OpenSSH semantics (first-match-wins + Include expansion at the point the Include appears) via _resolve_sshd_effective()
• New: Persistence & Backdoor Scan (Option 16) - sweeps cron, systemd units and shell rc files for backdoor-style entries (reverse shells, curl | sh downloads, base64-decoded payloads, cryptomining pools). Detection only; removal stays a manual IR decision. Patterns tunable via PERSISTENCE_SUSPICIOUS_PATTERNS in config.py
• New: Privilege Escalation Audit (Option 17) - SUID/SGID enumeration with risk classification (world-writable or in /tmp = hard alert, off the common-legitimate list = review), non-root UID-0 accounts, empty password hashes, NOPASSWD sudo rules. SUID walk has a timeout with a standard-directories fallback for very large filesystems
• New: suspicious-path / deleted-binary process detection - flags processes whose /proc//exe resolves into /tmp, /dev/shm or /var/tmp, or to a "(deleted)" path (binary unlinked after launch). Runs in daemon mode too - it's a cheap /proc-only read
• Fixed false positives in check_suspicious_processes: substring matching ('nc' in line) against the whole ps line flagged rsync, once.py, vnc and every routine curl/wget download. Now matches whole words (\bnc\b) against the COMMAND column only, and curl/wget only count when piped into a shell
• Migrated off deprecated netstat: analyze_traffic and monitor_suspicious_connections now use ss (netstat is absent on modern minimal installs, where both checks silently returned 0 forever) with netstat as fallback
• Fixed a dead check: monitor_suspicious_connections regex-matched ESTABLISHED lines for 0.0.0.0/255.255 - a pattern that can never appear as an ESTABLISHED peer, so it returned nothing, always. Now flags established connections to malware-associated ports (Metasploit defaults, IRC C2 range, classic trojans) - verified against real ss output's actual column layout (4-column data rows)
• Fixed off-by-one: scan_system_vulnerabilities counted apt's "Listing..." header line as an outdated package, reporting 1 update pending on fully-updated systems
• Made monitor_file_access real: it printed "Monitoring N critical files" and monitored nothing. Now checks actual ownership/permissions (world-writable passwd, world-readable shadow, group/world-accessible authorized_keys) with basename-keyed rules
• Made the Advanced Comprehensive Report (Option 13) data-driven: it was a static HTML template where every module was hardcoded "✓ Active/Enabled/Applied" regardless of the actual system - a fresh unhardened install produced the identical all-green report as a locked-down one. Statuses are now rendered from live check results
• Daemon mode now also runs the persistence scan and suspicious-path process check each cycle (both cheap); the SUID filesystem walk deliberately stays out of the daemon (too heavy for a periodic loop) and remains in Option 17
• Report generation (Options 8/13) and the full assessment (Option 14) now include persistence, privesc, suspicious-path process and critical-file permission findings
• Menu renumbered: 16 = Persistence Scan, 17 = Privilege Escalation Audit, Exit moved to 18
• 31 new unit tests (69 total, all passing): first-match-wins/include resolution (4 scenarios incl. the cloud-init drop-in case), word-boundary process matching, malware-port connection detection against realistic 4-column ss output, persistence pattern matching, SUID risk classification, UID-0/empty-password detection, critical-file permission checks, suspicious-path process scanning, ss-primary/netstat-fallback behavior, and the apt header off-by-one

v1.4 (2026)

• Every capability the README previously described with no code behind it now has a real, tested implementation:
  • ICMP Flood Protection and IP Spoofing Protection (Option 3)
  • ARP Spoofing / basic Man-in-the-Middle Detection (Option 10)
  • Command Injection signatures added to the Option 15 web attack scan
  • Kernel Module Analysis and basic Rootkit Indicators (Option 11)
  • Real syscall-level audit rules via auditd (execve, connect) plus a query command (Option 5 to enable, Option 6 to check)
  • Running Service review, with optional allowlist checking via EXPECTED_SERVICES in config.py (Option 1)
• Fixed a pre-existing bug where enable_audit_logging printed "ENABLED" even when it failed or auditd wasn't installed
• Daemon mode now also runs the web attack scan and ARP spoofing check each cycle
• Full audit of every claim in "Threat Protection Capabilities" against the actual code - anything without a real implementation was either built for real (this release) or removed from the list
• Web Attack Scan (Option 15) now tails the access log incrementally (tracks byte offset, rotation-aware) instead of re-reading and re-scanning the entire file every cycle - keeps daemon mode's cost proportional to recent traffic, not total log size, on a busy server
• File Integrity Checking (Option 11) now actually compares against a stored baseline and reports what changed, instead of only computing and printing hashes with nothing to compare against
• Real-time Monitoring (Option 7) now actually checks something each iteration (suspicious IPs, ARP spoofing) instead of an empty sleep loop
• Report generation (Options 8/13) now includes the v1.4 checks (rootkit indicators, kernel modules, ARP spoofing, running services), not just the original v1.3 set
• Removed two README claims that weren't backed by code ("deep packet inspection", "automatic real-time mitigation") and rewrote Performance Considerations / Limitations with specifics instead of generic boilerplate
• Fixed a version-string inconsistency: some code comments/banners still said v1.3 after the README had already moved to v1.4
• Fixed enable_udp_flood_protection: it called a sysctl key (net.ipv4.udp_ratelimit) that does not exist in the Linux kernel (verified against kernel.org's ip-sysctl docs) and always claimed "ENABLED" regardless of the (always-failing) result. Replaced with a real per-source iptables hashlimit rule, the same mechanism already used for TCP/ICMP
• Removed remaining marketing language across the README, banner, and generated HTML reports ("enterprise-grade", "Advanced Security Tool", "Professional reports", hardcoded/inaccurate "100% Coverage" and module-count metrics) in favor of accurate, specific descriptions
• Security fix: the file integrity baseline moved from /var/tmp (predictable, often world-writable) to /var/lib/cyber-defense-shield - a local attacker who could write to the old location could update the baseline to match their own tampering and defeat the check entirely
• Added --dry-run: previews every state-changing action (firewall rules, SSH/sudo hardening, sysctls, service changes, apt-get upgrade) without applying it; detection/reporting still run normally. SSH/sudo hardening validate the proposed config against a temp file (sshd -t / visudo -c) so dry-run tells you whether it would actually pass, not just what command would run
• Added config.py validation at startup - catches wrong types/values (e.g. a threshold set to a string, a negative rate limit) with a clear message instead of a confusing traceback deep inside some method
• Added a basic test suite (tests/test_defense_modules.py, stdlib unittest only) covering web-attack-scan tailing/rotation, ARP spoofing detection, kernel module comparison, config validation, and --dry-run's command interception
• Documented an optional, reduced-privilege systemd configuration for --daemon (capabilities instead of full root) in cyber-defense-shield.service - commented out by default since it needs verification on your specific distro, but available for anyone who wants it
• Added a prominent "not a replacement for a WAF/EDR/antivirus" warning at the top of the README and printed by the app itself on startup
• Web Attack Scan rotation detection now also checks the log file's inode, not just its size - catches a rotation the size check alone could miss if the new file happens to already be larger than the old offset before the next check
• Added real rkhunter integration (Option 11): runs an actual scan if installed, gives install instructions if not, instead of relying solely on this project's own basic rootkit heuristics
• Added MalwareDetector.BASELINE_FILE permissions/location note and 4 more unit tests (inode rotation, dependency-check-adjacent logic) - 16 tests total
• Fixed a real gap between claim and code: the file integrity baseline's docstring said it was chmod'd 0600 - it wasn't actually chmod'd anywhere. Now it is (0600 file, 0700 directory, created if missing)
• Atomic config writes: harden_ssh and harden_sudo now write to a temp file and os.replace() into place, instead of appending/writing the real file directly - a process killed at the wrong instant can no longer leave sshd_config or a sudoers.d file half-written. Sudo hardening now validates with visudo -c before the file ever exists at its real path, not after
• Added ALERT_COOLDOWN_SECONDS (default 300s): Telegram/Discord alerts are now rate-limited so a noisy period doesn't spam every daemon cycle - findings are still logged every cycle regardless, only the push notification is throttled
• 4 more unit tests for the atomic-write pattern and alert cooldown - 20 tests total
• Fixed a real lockout risk: harden_ssh now checks for at least one populated authorized_keys file (root and/or the invoking SUDO_USER) before restarting ssh, and prints an unmissable warning if none is found - sshd -t only validates config syntax, it says nothing about whether anyone could actually still log in once password auth is off
• Fixed a real data-leak risk: AlertNotifier now redacts likely secrets (password/token/API-key patterns, mysql-style -pVALUE flags, Bearer tokens) from finding text before it's sent to Telegram/Discord - some findings originate from raw ps aux/log lines, which can legitimately contain a password someone put on a command line
• Verified (not just claimed) that no subprocess call anywhere uses shell=True or string-built commands - every call site uses list-form arguments, which is what actually prevents shell/command injection regardless of what a config value contains
• 6 more unit tests for alert redaction - 26 tests total
• Added TRAFFIC_ANOMALY_THRESHOLD_MBPS to config.py (was used via _cfg() with a hardcoded fallback, but silently missing from config.py itself, so it wasn't actually tunable the way the docs described) and closed 3 similar validation gaps for recently-added settings
• Fixed a real reporting gap: Option 10's suspicious-connection findings were checked and printed individually, but silently never made it into the final "THREATS DETECTED" summary - only ARP findings were. Now both are
• Fixed the same class of gap in Option 11: suspicious-process findings from scan_executable_behavior() were detected and printed individually but never summarized, unlike suspicious files and rootkit indicators
• Fixed check_cve_updates: it ran apt list --upgradable, captured the result, and then never looked at it - always printing "Complete" and returning True regardless of what apt actually reported or whether the command even succeeded. Now it reports the actual upgradable count and correctly returns False on a failed apt call
• 2 more unit tests for CVE-check reporting - 28 tests total
• Fixed a significant false-confidence bug in check_ssh_security: it checked whether directive names appeared anywhere in sshd_config and whether the word "no" appeared anywhere in the file - neither actually verifies a directive's value. Verified with a real test config before fixing: a completely insecure config (PermitRootLogin yes, PasswordAuthentication yes) was being reported as "SECURE". Now parses each directive's actual value
• Fixed the same class of bug in check_firewall: it checked 'active' in status_output, but the string "inactive" contains "active" as a substring - a fully disabled firewall was being reported as ACTIVE. Verified with real ufw status output before fixing. Now checks for the exact phrase "status: active"
• Fixed duplicate-counting in check_suspicious_processes and scan_executable_behavior: a single process line matching more than one suspicious keyword/pattern (e.g. a line containing "ncat", which also contains "nc") was being added to the findings list once per matching pattern instead of once
• Systematically re-verified detection logic that was previously only "doesn't crash" tested, this time with realistic mocked tool output asserted against known-correct results: suspicious-IP threshold detection, per-source SYN-flood/port-scan classification, the EXPECTED_SERVICES allowlist (both populated and empty), and 777-permission file detection against real files on disk
• Fixed 2 reporting gaps: suspicious-connection findings (Option 10) and suspicious-process findings (Option 11) were detected and printed individually but never made it into the final summary block, unlike other finding types in the same options
• 12 more unit tests covering all of the above - 38 tests total

v1.3.1 (2026)

• Added Web Attack Scan (Option 15): actually wires up the SQL_INJECTION/XSS/PATH_TRAVERSAL signatures in config.py's ATTACK_PATTERNS to a real check against nginx/apache access logs - these patterns previously existed in config.py but were never read by any code
• Telegram/Discord alert credentials now read from environment variables (CDS_TELEGRAM_BOT_TOKEN, CDS_TELEGRAM_CHAT_ID, CDS_DISCORD_WEBHOOK_URL) instead of needing to be hardcoded in config.py, so they can't end up committed to the public repo by accident
• Daemon mode now uses Python's logging module with size-based log rotation (5MB x 3 backups) instead of an unbounded manual file write
• Daemon mode cycles now also run the Web Attack Scan

v1.3 (2026)

• Added --daemon mode: runs detection continuously in the background instead of only via the interactive menu, on a configurable interval (see cyber-defense-shield.service for systemd deployment)
• Added optional Telegram and Discord alerts, sent automatically when daemon mode finds something actionable (both off by default, stdlib-only, no new dependency)
• Daemon mode intentionally only runs detection checks (IDS, suspicious IPs/processes/files) - it does not re-apply firewall/SSH/sudo hardening or run system updates automatically on a timer
• SSH hardening is now idempotent (marker-guarded) and takes a one-time backup of the original sshd_config, validated with sshd -t before being applied
• iptables rate-limiting rules are now checked with iptables -C before being added, preventing duplicate rules on repeated runs, and are persisted across reboots via netfilter-persistent/iptables-save
• Sudo hardening, incoming-traffic monitoring, syslog analysis, and attack-pattern detection now perform real checks instead of placeholder output
• Security reports now reflect live system state (firewall/SSH/ports/suspicious IPs) instead of a static checklist
• Removed unused dependencies from requirements.txt (now only psutil, which is actually used)

v1.2 (2026)

• Rate limiting is now enforced per source IP (iptables hashlimit) instead of one shared global limit, so concurrent legitimate users no longer exhaust each other's allowance
• SYN flood protection now also raises the SYN backlog size, giving legitimate traffic bursts more headroom before syncookies kick in
• Port scan and SYN flood detection in the IDS are now grouped per source IP instead of a single system-wide counter
• Brute force detection now uses a configurable recent time window instead of a lifetime log total
• Suspicious-IP detection now requires an actual connection-count signal instead of flagging every remote address seen
• All of the above thresholds are now configurable in config.py

v1.0 (2026)

• Initial release
• Core security modules
• DDoS protection
• Firewall management
• System hardening
• Log analysis
• Report generation

Roadmap

• CIS Benchmark compliance checking (a real subset of controls, not just the current unused COMPLIANCE config flag)
• Historical trend tracking across scans (needs persistent storage - currently every scan is stateless)
• Machine learning threat detection
• Cloud integration support
• Mobile app for monitoring
• Advanced threat intelligence
• SIEM integration
• Kubernetes support

License

MIT License - See LICENSE file for details

MIT License

Copyright (c) 2026 Cyber-Rage Security Team

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

Authors

Cyber-Rage Security Team

Open-source, MIT-licensed Linux security tooling.

Team Members

• Security Architecture
• Threat Analysis
• System Administration
• Penetration Testing

Acknowledgments

Special thanks to:

• Linux security community
• Open-source contributors
• Security researchers
• Beta testers

---

Version: 1.5 Last Updated: 2026 Status: Active Development & Maintenance Maintained By: Cyber-Rage Security Team

Protect Your Systems. Defend Your Network. Secure Your Future.