Intelligent-FIM-AI

# Intelligent FIM AI

An intelligent File Integrity Monitoring (FIM) tool built in Python. This tool monitors target directories in real-time, detecting abnormal file modifications using SHA-256 hashes and Scikit-Learn's `IsolationForest` machine learning algorithm. 

## Features
- **Real-Time Monitoring:** Utilizes `watchdog` to catch file creations and modifications instantly.
- **Hash Verification:** Tracks SHA-256 hashes to prevent false positives from non-content metadata changes.
- **AI Anomaly Detection:** Extracts file metadata (size, extension risk, Shannon entropy) and feeds it into an Isolation Forest model to detect anomalous behavior.
- **Automated Security Explanations:** Generates human-readable context for why a specific file event was flagged as an anomaly (e.g., detecting ransomware-like high entropy or high-risk extensions).

## Author
- **Name:** Abdul Muqeet Tabraiz
- **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
- **GitHub:** [JuttSahib1999](https://github.com/JuttSahib1999)

## Architecture
The application runs a multi-threaded watchdog observer. When a file is modified, the `monitor.py` script calculates the hash and extracts features. These features are passed to `analyzer.py`, which evaluates them against the Isolation Forest baseline. If flagged, `explainer.py` generates the heuristic reasoning.

## Installation & Setup
1. Clone the repository.
2. Install the requirements: `pip install -r requirements.txt`
3. Run the monitor: `python src/main.py -d "C:\Users\abdul\Desktop\FIM_Test"` (or use the provided `run_fim.bat` script).

## Screenshots

### 1. Test Directory Structure
Here is the monitored `FIM_Test` directory on Windows containing our test files (`notes.txt` and `mal.enc`):
![FIM Test Directory Structure](screenshots/FIM_Test.png)

### 2. AI Anomaly Detection & Security Explanations
Here is the VS Code terminal running the tool, displaying real-time monitoring, anomaly score evaluations, and automated AI security explanations when high-risk extensions like `.enc` are detected:
![AI Anomaly Detection Terminal Output](screenshots/mal.png)

## License
MIT License