BehaviorShield

Real-Time AI-Based Behavioral Threat Detection

---

What is this?

BehaviorShield is a lightweight real-time monitoring system that detects abnormal system behavior using AI.

Instead of relying on fixed thresholds, it learns normal CPU, memory, network, and GPU patterns — and flags unusual activity such as:

• Cryptomining abuse
• Ransomware-like encryption spikes
• Suspicious background workloads
• GPU resource hijacking

It focuses on behavior change over time, not just high usage.

---

What makes it different?

• Learns baseline system behavior automatically
• Uses Isolation Forest for anomaly detection
• Adds temporal pattern analysis
• Combines multiple signals into a single risk score
• Streams live detection results via WebSocket
• Fully explainable risk scoring

Core idea: Detect early abnormal behavior before visible damage occurs.

---

How it works

1. Collect system metrics
2. Store in rolling window
3. Compute behavioral features
4. Run anomaly detection
5. Apply temporal & contextual checks
6. Generate risk score
7. Stream live results to dashboard

---

Tech Stack

• FastAPI
• Scikit-learn (Isolation Forest)
• WebSockets
• Async streaming
• JavaScript dashboard

---

How to Run

1️ Clone the repo

git clone https://github.com/GaliAkshatha/BehaviorShield.git
cd BehaviorShield

2️ Create virtual environment

python -m venv venv
venv\Scripts\activate

3️ Install dependencies

pip install -r requirements.txt

4 Run backend

uvicorn main:app --reload

open

http://127.0.0.1:8000/docs

Open index.html using Live Server to view the real-time dashboard.

Why we built this

Modern systems are vulnerable to silent resource abuse. Most monitoring tools detect crashes — not behavioral anomalies.

BehaviorShield focuses on early behavioral detection using AI.