AI-Vulnerability-Scanner - An AI-driven vulnerability scanner that uses Nmap

项目说明

AI-Dri Scanner & Remediation System

---

Table of Contents

1. Project O
2. Features
3. Architecture
4. Setup & Installation
- Prerequisites
- Clone & Install Dependencies
- En Setup
5. Usage
- Running the Server
- Web Interface
- Scan Workflow
- Remediation Workflow
6. Project Structure
7. Model Training
8. Troubleshooting
9. Future Impro
10. References

---

Project O

This repository contains an AI-dri scanning and remediation system. Given a user-provided IP address, the system performs:

1. Network Scanning: Uses Nmap to discover open TCP ports and service .
2. Matching: Utilizes SBERT embeddings to semantically match discovered services with relevant C (2023–2025) from the NVD.
3. Se Classification: Applies a RandomForest classifier (trained on C and C) to categorize each CVE into Low, Medium, High, or Critical.
4. Remediation Generation: Fine-tunes a T5 model to generate customized remediation steps for each C.
5. Web Interface: Provides a browser-based UI (HTML/CSS/Ja) that allows real-time scanning and remediation lookups.

---

Features

Real-Time Scanning: Enter an IP address and instantly scan for open services using Nmap.

C: For each service, retrie matching C on semantic similarity.

Se Ranking: Classify CVEs by se to help prioritize remediation.

AI-Generated Fixes: Generate human-readable remediation instructions using a fine-tuned T5 model.

User-Friendly UI: Interactive web interface with progress spinners and result tables.

---

Architecture

1. Frontend (Browser):
- HTML/CSS for layout and styling.
- Ja (app.js) to call backend APIs and render results.
- Spinner to indicate scan progress.

2. Backend (FastAPI):
- /api/scan: Receives { ip }, runs Nmap , parses output, computes SBERT similarity against C, returns list of services with top-3 CVEs.
- /api/fix: Receives { description }, computes SBERT similarity against C, retrie CVEs, generates T5 remediation.
- Models and embeddings are loaded at startup (@app.on_event("startup")).

3. Data & Models:
- C: data/processed/c.csv containing CVE_ID, description, C, attack_, se, remediation_steps (for training).
- SBERT Embeddings: Precomputed 384-dim for 80k C.
- RandomForest Classifier: Trained on SBERT embeddings to predict se.
- T5 Remediation Model: Fine-tuned T5-small with safetensors under models/checkpoint-53500.

---

Setup & Installation

Prerequisites

Operating System: Windows 10/11, macOS, or Linux

Python: 3.10.x

Nmap: Latest (v7.95+), ensure nmap or nmap.exe is on your PATH.

Git: For cloning the repository.

Clone & Install Dependencies

Contents of requirements.txt:

En Setup

No additional en are required. Ensure Nmap is installed and accessible:

---

Usage

Running the Server

From the project root:

You will see console logs indicating:

Web Interface

Open your browser and na to:

You should see the AI-Dri Scanner UI.

Scan Workflow

1. Enter IP Address: In the input box labeled “Enter IP to scan”, type an IPv4 address (e.g., scanme.nmap.org, 127.0.0.1, or a local network IP).
2. Click “Scan”: A circular spinner appears, showing progress.
3. View Results: After Nmap completes (first 1000 ports, detection), a table appears:

| Port | Service | Top CVEs |
|------|-------------------|----------------------------------------|
| 22 | ssh OpenSSH_7.4 | C (HIGH)<br>C (MEDIUM) … |
| 80 | http Apache/2.4.29| C (CRITICAL)<br>… |

Remediation Workflow

1. Paste a C: In the “Get C” textarea, paste any C (e.g., “Apache HTTP Ser 2.4.29 …”).
2. Click “Get Fixes”: The spinner appears briefly as the T5 model generates fixes.
3. View Fix: A list appears with up to 5 CVE IDs, their se, and the AI-generated remediation text:

- C (CRITICAL): “Update Apache to 2.4.41 or later …”

---

Project Structure

---

Model Training

If you need to retrain or update the models:

1. Ensure c.csv is present: Contains CVE_ID, Description, CVSS, Se, Remediation_Steps, etc.
2. Run Training Script:

- Trains a RandomForest se classifier (models/se.pkl).
- Fine-tunes T5-small for remediation, saving to models/checkpoint-53500/.

---

Troubleshooting

Nmap not found:

- Ensure you installed Nmap from and added it to PATH.
- Running nmap -- should print info.

Port Scan Returns Empty:

- Check network/firewall settings.
- Try scanning a known host (e.g., 127.0.0.1 or scanme.nmap.org).

Spinner Stuck at 0%:

- Confirm app.js loaded appears in your browser’s console.
- Use Opera GX’s De (Ctrl+Shift+I) → Console, Network to inspect /api/scan requests.

Model Loading Errors:

- Ensure models/checkpoint-53500/ contains config.json, spiece.model, pytorch_model.bin or model.safetensors.
- If you see a pickle/safetensors error, update app.py to use from_pretrained(..., local_files_only=True).

---

Future Impro

Precompute & Cache Service Embeddings: Speed up per-scan C.

Expand CVE Data Sources: Include ExploitDB, GitHub Security Ad.

Enhance UI: Add pagination, filters (by se), and CS.

Dockerize: Provide a Dockerfile for containerized deployment.

Risk Scoring: Incorporate asset context and business criticality into prioritization.

---

References

1. National Database (NVD): CVE JSON Feeds –
2. Reimers & Gurevych (2019): Sentence-BERT –
3. Raffel et al. (2020): Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer –
4. python-nmap: Python wrapper for Nmap –
5. Hugging Face Transformers –
6. Nmap Reference Guide –

项目信息

开发语言：HTML

Star 数：46

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An AI-driven vulnerability scanner that uses Nmap to discover open services on a user-supplied IP, matches each service to relevant CVEs via SBERT embeddings and a severity classifier, and generates tailored remediation steps using a fine-tuned T5 model. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。