Back to Projects
ai-threat-intel-platform
AI-powered threat intelligence platform for automated IOC collection, malware campaign detection, and relationship mapping.
0
Stars
0
Forks
0
Watchers
0
Open Issues
README.md
# 🛡️ AI Threat Intelligence Platform
An **AI-powered threat intelligence platform** that automatically collects, analyzes, and correlates Indicators of Compromise (IOCs) from multiple open-source threat intelligence feeds. The platform uses artificial intelligence to identify malware campaigns, map relationships between threats, and generate comprehensive threat reports.
## 👨💻 Author
**Abdul Muqeet Tabraiz**
[](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
[](https://github.com/JuttSahib1999)
## ✨ Features
- 🔍 **Automated IOC Collection**: Gathers threat data from AlienVault OTX, URLhaus, MalwareBazaar, and ThreatFox
- 🧠 **AI-Powered Analysis**: Natural language processing for threat intelligence analysis
- 🔗 **Relationship Mapping**: Graph-based analysis to identify connections between IOCs
- 🎯 **Campaign Detection**: Automatic identification of malware campaigns and attack patterns
- 📊 **Comprehensive Reports**: Generate detailed HTML, JSON, and text reports
- 💾 **Persistent Storage**: SQLite database for storing and querying threat data
- 📈 **Threat Scoring**: Automatic risk scoring based on multiple factors
- 🌐 **Cross-Platform**: Works on Windows, Linux, and macOS
## 📋 Prerequisites
- **Python 3.8 or higher**
- **Windows 10/11**, Linux, or macOS
- **Internet connection** (for collecting threat feeds)
- **4GB RAM minimum** (8GB recommended)
- **1GB free disk space**
## 🚀 Quick Start (Windows 10/11)
### Method 1: Using run.bat (Easiest)
1. **Download and extract the project**
2. **Double-click `run.bat`**
3. The script will automatically:
- Create a virtual environment
- Install all dependencies
- Set up directory structure
- Run the threat intelligence platform
4. **Check `data/reports/` for generated reports**
### Method 2: Manual Installation
1. Open Command Prompt or PowerShell
2. Navigate to the project directory:
```bash
cd ai-threat-intel-platform
```
3. Create virtual environment:
```bash
python -m venv venv
```
4. Activate virtual environment:
```bash
venv\Scripts\activate
```
5. Install dependencies:
```bash
pip install -r requirements.txt
```
6. Run the platform:
```bash
python -m src.main
```
## 📁 Project Structure
```text
ai-threat-intel-platform/
├── src/
│ ├── collectors/ # Threat feed collectors
│ │ ├── alienvault_collector.py
│ │ ├── urlhaus_collector.py
│ │ ├── malwarebazaar_collector.py
│ │ └── threatfox_collector.py
│ ├── analyzers/ # AI analysis engines
│ │ ├── ai_analyzer.py
│ │ ├── relationship_mapper.py
│ │ └── campaign_detector.py
│ ├── reporters/ # Report generation
│ │ └── report_generator.py
│ ├── database/ # Data persistence
│ │ └── db_manager.py
│ ├── utils/ # Utilities
│ │ ├── config.py
│ │ └── helpers.py
│ └── main.py # Main entry point
├── data/ # Output directory
│ ├── iocs/ # Raw IOC data
│ ├── reports/ # Generated reports
│ └── database/ # SQLite database
├── tests/ # Unit tests
├── templates/ # Report templates
├── requirements.txt # Python dependencies
├── setup.py # Package setup
├── run.bat # Windows launcher
└── README.md # Documentation
```
## 🔧 Usage
### Basic Usage
Run with default settings:
```bash
python -m src.main
```
### Programmatic Usage
```python
from src.main import ThreatIntelligencePlatform
# Initialize platform
platform = ThreatIntelligencePlatform()
# Run analysis
platform.run()
```
### Custom Integration
```python
from src.collectors.alienvault_collector import AlienVaultCollector
from src.analyzers.ai_analyzer import AIThreatAnalyzer
# Collect IOCs
collector = AlienVaultCollector()
iocs = collector.collect()
# Analyze threats
analyzer = AIThreatAnalyzer()
analysis = analyzer.analyze_ioc_correlations(iocs)
print(f"Analysis complete: {analysis}")
```
## 📊 Sample Output
```text
╔══════════════════════════════════════════════════════════╗
║ AI THREAT INTELLIGENCE PLATFORM v1.0.0 ║
║ Author: Abdul Muqeet Tabraiz ║
║ Date: July 20, 2026 ║
╚══════════════════════════════════════════════════════════╝
[1/5] Collecting IOCs from free sources...
[+] Total IOCs collected: 847
[2/5] Storing IOCs in database...
[+] IOCs stored successfully
[3/5] Analyzing IOCs with AI...
[+] Analysis complete
- Malware families identified: 23
- IOC types: {'ip': 312, 'domain': 245, 'url': 190, 'hash': 100}
- Average threat score: 6.8/10
[4/5] Detecting threat campaigns...
[+] Campaigns detected: 7
- EMOTET_2026-07-04: emotet (89 IOCs)
- TRICKBOT_2026-07-03: trickbot (67 IOCs)
[5/5] Generating threat reports...
[+] Reports generated:
- HTML: data/reports/threat_report_20260720_120000.html
- JSON: data/reports/threat_report_20260720_120000.json
- TEXT: data/reports/threat_report_20260720_120000.txt
```
## 🧪 Running Tests
```bash
# Run all tests
python -m pytest tests/
# Run specific test file
python -m pytest tests/test_collectors.py
# Run with verbose output
python -m pytest tests/ -v
```
## 🛠️ Configuration
### API Keys (Optional but Recommended)
For real threat intelligence data, sign up for free API keys:
* AlienVault OTX: https://otx.alienvault.com/api/
* Abuse.ch: https://bazaar.abuse.ch/api/
Copy and edit the API keys file:
```bash
cp src/utils/api_keys.example.py src/utils/api_keys.py
```
Add your keys:
```python
ALIENVAULT_API_KEY = "your-64-character-key-here"
ABUSE_CH_API_KEY = "your-48-character-key-here"
```
Without API keys, the platform works with realistic sample data for demonstration.
## 🤝 Contributing
Contributions are welcome! This is version 1.0.0 and is considered complete for its initial release. However, you can:
1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Submit a pull request
## 📄 License
This project is licensed under the MIT License - see the LICENSE file for details.
## ⚠️ Disclaimer
This platform is for educational and defensive purposes only. Always ensure you have proper authorization before monitoring or analyzing any networks or systems. The author is not responsible for any misuse of this software.
## 🎯 Key Features in Detail
### AI Analysis Capabilities
1. Natural language processing of threat descriptions
2. Automatic malware family identification
3. Industry sector targeting analysis
4. Attack vector classification
5. Threat sentiment analysis
### Relationship Mapping
1. Graph-based IOC correlation
2. Community detection for campaign identification
3. Central node analysis
4. Path finding between related threats
### Report Generation
1. **HTML Reports:** Interactive, styled reports with tables and statistics
2. **JSON Reports:** Machine-readable format for integration
3. **Text Reports:** Plain text summaries for quick review
## 📈 Performance
1. Processes 1000+ IOCs per run
2. Average execution time: 2-5 minutes
3. Database supports millions of records
4. Memory efficient design
## 🔒 Security Notes
1. All API requests are rate-limited
2. No sensitive data is transmitted externally
3. Local database storage only
4. Input validation on all collected data
## 🌟 Support
**For issues, questions, or suggestions:**
* GitHub Issues: [Create an issue](https://github.com/JuttSahib1999/ai-threat-intel-platform/issues)
* LinkedIn: [Connect with the author](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
## 📝 Changelog
### Version 1.0.0 (July 20, 2026)
* Initial release
* Four threat intelligence sources integrated
* AI-powered analysis engine
* Campaign detection system
* Multiple report formats
* Cross-platform support
---
**Built with ❤️ by Abdul Muqeet Tabraiz**
Last Updated: July 20, 2026
```
```