mitre-attack-ai-mapper

# 🛡️ AI MITRE ATT&CK Mapper

An AI-powered application designed to analyze raw security events, logs, and incident descriptions, automatically mapping them to the most relevant [MITRE ATT&CK](https://attack.mitre.org/) techniques using Natural Language Processing (TF-IDF & Cosine Similarity).

---

## 🖼️ Screenshots

<p align="center">
  <table>
    <tr>
      <td align="center" width="50%">
        <b>Main Interface</b><br><br>
        <img src="assets/screenshots/main_interface.png" alt="Main Interface" width="100%">
      </td>
      <td align="center" width="50%">
        <b>Test Case 1: Obfuscated PowerShell</b><br><br>
        <img src="assets/screenshots/test1.png" alt="Test Case 1 Analysis" width="100%">
      </td>
    </tr>
  </table>
</p>

<p align="center">
  <b>Test Case 2: LSASS Memory Dumping</b><br><br>
  <img src="assets/screenshots/test2.png" alt="Test Case 2 Analysis" width="80%">
</p>

---

## ✨ Features

* **100% Free & Local NLP:** Uses `scikit-learn` for intelligent keyword and semantic matching without requiring paid API keys.
* **Always Up to Date:** Pulls the latest Enterprise ATT&CK matrix dynamically from MITRE's official CTI repository on launch.
* **Confidence Scoring:** Assigns percentage-based confidence scores to mapped techniques.
* **Production Ready:** Built with Streamlit for a fast, responsive, and deployable web interface.

---

## 🚀 Quick Start (Windows 10)

1. **Clone the repository:**
```cmd
git clone https://github.com/JuttSahib1999/mitre-attack-ai-mapper.git
cd mitre-attack-ai-mapper

```


2. **Create and activate a virtual environment** (Python 3.13 or 3.14 recommended):
```dos
py -3.13 -m venv venv
.\venv\Scripts\activate

```


3. **Install dependencies:**
```dos
pip install -r requirements.txt

```


4. **Run the application:**
```dos
streamlit run app.py

```



---

## 👤 Author

Created by **Abdul Muqeet Tabraiz**

* **GitHub:** [@JuttSahib1999](https://github.com/JuttSahib1999)
* **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)

---

## 📄 License

This project is licensed under the MIT License - see the `LICENSE` file for details.