digital-identity-protection-system - Cross-platform defensive security platform for ide

项目说明

DIPS | Digital Identity Protection System

!Python 3.11+
!License
!
!Beta
!Test Co
!Security Focused
!Windows
!Linux
!PySide6
!Reports
!Demo Mode

<a href="#quick-start">Quick Start</a> ·
<a href="#downloads">Downloads</a> ·
<a href=" Release</a> ·
<a href="examples/reports">Example Reports</a> ·
<a href="#showcase-reel">Showcase Reel</a> ·
<a href="#screenshots">Screenshots</a>

Local-first identity security for Windows and Linux.

DIPS is a defensi tool for operators, pri users, and engineers who want into identity exposure, credential hygiene, local privacy leaks, risky browser posture, phishing indicators, threat intelligence matches, and cross-module risk patterns without depending on a cloud-first workflow.

It combines a production-style Python CLI, redacted JSON and HTML reports, a configurable Digital Identity Risk Score, a PySide6 desktop dashboard, a persistent security timeline, and a plugin system for external security modules.

</td>
<td ="top" width="340">
<img src="screenshots/repo-typing-analyst.gif" alt="Animated SOC analyst typing at a workstation" width="320">
</td>
</tr>
</table>

> Defensi. DIPS does not exploit systems, weaponize findings, or decrypt protected browser .

Beta Access

DIPS is ready for a free early-access beta with stable core workflows and support-oriented diagnostics.

Recommended beta workflow:

run dips doctor before the first scan

use dips scan normally for e e

include redacted dips doctor --doctor-format json output when filing issues

use beta feedback or the normal bug template for support

Project Snapshot

Tagline: Local-first identity risk detection with a SOC-style desktop dashboard.

GitHub description: Cross-platform defensi platform for identity exposure detection, breach intelligence, phishing analysis, and pri reporting.

Who it is for: security engineers, blue-team builders, pri operators, and recruiters looking for strong Python security engineering work.

Why it stands out: the repository combines CLI engineering, modular analysis pipelines, secure-by-default reporting, desktop UX, plugin extensibility, and release-ready packaging in one coherent project.

Why DIPS

Local-first scanning with optional provider integrations instead of mandatory cloud telemetry.

Cross-platform support for Windows and Linux from the same codebase.

Professional runtime surface: typed config, structured logging, tests, CI, reports, dashboard, and plugin architecture.

Pri defaults: redacted reports, hashed breach identifiers, bounded local caches, and graceful failure handling.

Modular design that supports new scanner modules, report extensions, and defensi without rewriting the core engine.

Key Features

Identity Exposure Scanner for emails, tokens, secrets, pri markers, and risky plaintext artifacts.

Breach Intelligence module with hashed identifier lookup, offline breach datasets, provider abstraction, and local caching.

Credential Hygiene analysis for weak passwords, common-password matches, reuse, and identifier-based password weakness.

Local Privacy Risk scanning for exported credentials, shell history exposure, permission issues, and risky local stores.

Browser Security Audit for Chromium-family and Firefox profiles, sa indicators, unsafe settings, and extension sprawl.

Email and Phishing Analyzer for suspicious links, header anomalies, authentication failures, urgent lures, and risky attachments.

Threat Intelligence enrichment for URLs, domains, and IPs with local feeds, optional online lookups, and IOC correlation.

AI Security Analysis for plain-language summaries, risk explanations, suspicious-pattern detection, and remediation advice.

Security Event Timeline and alert correlation across modules and across repeated scans.

JSON and HTML reporting designed for both automation and analyst review.

Runtime diagnostics with dips doctor for operator support and beta rollout .

Policy-gated scan exits for automation workflows and managed-service enforcement.

Premium PySide6 dashboard with SOC-style panels, scan history, trend charts, se heatmaps, and report loading.

Plugin System for external scanners, enrichment hooks, report extensions, and local tool integrations.

Engineering Highlights

Professional Python package with typed configuration, release metadata, build artifacts, and documented maintainer workflows.

Security-focused architecture with redaction, bounded local caches, defensive file handling, and graceful error boundaries.

Extensible runtime model that separates built-in scanners, ad modules, plugins, risk scoring, and reporting.

Portfolio-quality desktop UX with demo mode, screenshot-ready states, and SOC-style telemetry panels.

Contributor-friendly repo surface with focused docs, examples, templates, changelog structure, and release guidance.

Build Journey

If you want to understand how DIPS was built step by step, see docs/de.md.

!DIPS de phases

It breaks the project into fi phases:

foundation and defensi

core scanning capabilities

intelligence and risk correlation

reporting and analyst experience

product hardening and beta operations

Showcase Reel

!DIPS showcase reel

Screenshots

O dashboard:

!DIPS o dashboard

Risk score panel:

!DIPS risk score panel

Se distribution:

!DIPS se distribution

Security event timeline:

!DIPS security event timeline

Breach exposure alert view:

!DIPS breach exposure alert

Scan report view:

!DIPS scan report view

Identity exposure analysis:

!DIPS identity exposure dashboard

Threat intelligence panel:

!DIPS threat intelligence dashboard

More screenshot details are in screenshots/README.md.

Refresh the full screenshot set with:

Installation

Linux

Windows

Runtime-only desktop install:

Full installation guidance is in docs/installation.md.

Packaged release notes and downloadable assets live at Latest release.

Downloads

The repository now includes a direct download folder in downloads:

full PDF user guide

Debian .deb installer

checksums for shipped artifacts

If you install the Debian package, the en with:

Quick Start

Run the example configuration:

Run a targeted fixture-backed scan:

Launch the dashboard:

Open an existing report in the dashboard:

The full operator quick start is in docs/quickstart.md.

Operational Readiness

Run the built-in en diagnostics:

Get JSON diagnostics for support or managed rollouts:

Use DIPS as an automation gate without changing the default scan workflow:

Operational guidance is in docs/operations.md.

Demo Mode

DIPS includes a safe synthetic demo mode for screenshots, GitHub presentation, and dashboard walkthroughs.

Generate the bundled demo reports locally:

Launch the dashboard with staged demo data:

Load the committed sample incident report directly:

Capture a screenshot in one step:

Bundled sample demo reports live in examples/demo-reports.

Example Reports

The repository also ships a curated example report pack in examples/reports.

Included artifacts:

example JSON scan report

example HTML analyst report

risk scoring summary

alert findings example

Generate similar synthetic reports locally:

Generate real reports against your local en:

CLI Usage

Show help:

Core commands:

dips scan runs one full defensive scan and writes reports.

dips watch performs repeated foreground scans and shows new or resol.

dips show-config prints the merged effecti.

dips doctor runtime health, writability, configured inputs, and plugin loading.

dips dashboard launches the PySide6 desktop interface.

Examples:

See docs/cli.md for the complete CLI guide.

Dashboard Usage

The dashboard is designed to feel like a defensive SOC product while still reusing the same local scan engine as the CLI.

Key panels:

Identity Protection Score

Threat Intelligence Panel

Security Event Timeline

Alert Correlation View

Risk Trend Graph

Identity Exposure Map

Se Heatmap

Reports and exports

Launch options:

Detailed workflow guidance is in docs/gui.md.

Reports

DIPS exports:

JSON reports for automation, parsing, and integration

standalone HTML reports for sharing and analyst review

Each report includes:

scan metadata

module findings and warnings

Digital Identity Risk Score and label

category scores and top recommendations

timeline events and correlated patterns

plugin extensions when present

Report structure details are in docs/reports.md.

Architecture Summary

How to read it:

Interfaces feed operator intent and runtime options into config and the scan engine.

The scan engine builds context once, then dispatches built-in scanners, breach intelligence, threat intelligence, and any loaded plugins.

Findings flow into the event timeline for correlation and into the risk engine for scoring.

Local cache persists breach intel, threat intel, and timeline state without forcing cloud dependencies.

The reporting layer turns the final analysis into terminal summaries, JSON reports, HTML reports, and dashboard-ready payloads.

Key layers:

dips.core: config, engine, logging, timeline, plugin runtime, and risk engine

dips.scanners: built-in local defensi

dips.modules: ad enrichment modules such as breach, threat, and AI analysis

dips.reporting: JSON and HTML exporters

dips.gui and dips.ui_dashboard: desktop dashboard shell and public UI surface

plugins/: local plugin root and example plugin

Deep-di notes are in docs/architecture.md.
The Mermaid source of truth is in docs/architecture-diagram.mmd.

Repository Layout

| Path | Purpose |
| --- | --- |
| dips/core/ | scan orchestration, config, logging, timeline, plugin runtime, and risk scoring |
| dips/scanners/ | built-in local defensi |
| dips/modules/ | ad modules such as breach intelligence, threat intelligence, and AI analysis |
| dips/reporting/ | JSON and HTML report generation |
| dips/ui_dashboard/ | stable public dashboard surface |
| dips/gui/ | dashboard shell, state adapters, theme, and pages |
| config/ | defaults and example configuration files |
| examples/ | safe demo reports and usage-ready example flows |
| screenshots/ | curated GitHub and release |
| docs/ | operator, engineering, and release documentation |
| tests/ | automated regression, module, CLI, and dashboard co |
| plugins/ | example plugin and local plugin root |

Documentation index: docs/README.md

Documentation At A Glance

Start here: docs/quickstart.md

Project build journey: docs/de.md

CLI reference: docs/cli.md

Dashboard guide: docs/gui.md

Feature breakdown: docs/features.md

Architecture deep dive: docs/architecture.md

Plugin guide: docs/plugins.md

Release packaging: docs/releasing.md

Recruiter and GitHub positioning copy: docs/project-profile.md

Testing

Install the contributor en:

Run the quality checks:

More de guidance is in CONTRIBUTING.md.

Release packaging guidance is in docs/releasing.md.

Documentation Map

docs/installation.md

docs/quickstart.md

docs/de.md

docs/features.md

docs/architecture.md

docs/cli.md

docs/gui.md

docs/reports.md

docs/plugins.md

docs/module-de.md

docs/releasing.md

docs/troubleshooting.md

docs/faq.md

Roadmap

The roadmap is organized around practical defensi growth rather than speculati sprawl. The goal is to keep DIPS local-first, pri, and useful to both indi operators and larger security teams.

Near-Term Priorities

Additional threat intelligence sources with better feed health checks, per-provider trust scoring, and impro feed curation workflows.

Impro analysis for attachment triage, display-name impersonation, brand-lure detection, and better header anomaly correlation.

Enhanced dashboard analytics with richer trend views, in pivots, filter presets, and cleaner analyst workflows for repeated scans.

Broader plugin ecosystem support with better plugin templates, compatibility checks, and more example integrations for defensi.

Mid-Term Platform Expansion

Enterprise deployment mode with centralized policy bundles, team-safe config profiles, and multi-endpoint report collection while preserving local analysis boundaries.

Cloud monitoring integrations for appro platforms such as SIEM, SOAR, and alert-routing systems using explicit opt-in connectors.

More mature report comparison and longitudinal risk tracking so operators can see posture drift across weeks or incidents.

Expanded local hardening co for identity stores, endpoint artifacts, and browser-risk posture across more enterprise en.

Longer-Term Engineering Goals

Signed release artifacts and automated release pipelines for cleaner operator installation on Windows and Linux.

Deeper dashboard in surfaces such as incident workspaces, richer alert correlation, and higher-density trend analytics for large report sets.

A healthier external module ecosystem with stronger plugin , packaging guidance, and community-contributed scanner examples.

Additional pri enrichment paths that impro context without turning the product into a cloud-first telemetry system.

For a more detailed milestone breakdown, see docs/roadmap.md.

Contribution Guide

Contributions are welcome if they keep the project defensi, and cross-platform.

Expected standards:

add tests for behavior changes

preser and Linux support

redact sensiti in examples and screenshots

update documentation when CLI, config, dashboard, reporting, or plugin behavior changes

Start here:

CONTRIBUTING.md

docs/module-de.md

docs/plugins.md

If you want recruiter-facing or GitHub presentation copy for the project page, pinned repo slot, resume, or LinkedIn post, use docs/project-profile.md.

Security and Privacy Principles

DIPS is built around a local-first, defensi model. The tool is designed to impro without forcing users to trade away privacy just to understand their exposure.

Core principles:

Local-first security model: the default path keeps scanning, analysis, reporting, and dashboard review on the local machine.

Pri design: exported e is redacted by default, demo assets use synthetic data, and sensiti are handled carefully.

Minimal external dependencies: the core product remains useful without mandatory cloud services, with optional integrations only when the operator enables them.

Defensi focus: DIPS is for detection, explanation, remediation, and analyst , not exploitation or weaponized workflows.

Safe handling of sensitive data: bounded caches, safer file handling, controlled plugin loading, and careful output formatting reduce accidental disclosure.

Transparent reporting: JSON, HTML, dashboard views, and scoring outputs are meant to show what was found, why it matters, and what to do next.

Why this matters:

identity and browser findings can be highly sensitive

pri users should not need to upload local data just to assess risk

defensi tooling should reduce risk, not create a second data-exposure problem

Full philosophy and rationale: docs/security-philosophy.md

Operational security guidance:

SECURITY.md

docs/security-philosophy.md

docs/troubleshooting.md

docs/faq.md

Ownership and Attribution

This repository includes an explicit LICENSE, NOTICE, and CITATION.cff file so the project authorship, attribution expectations, and preferred citation are in the repository itself.

Important:

public GitHub helps pro through commit history, release history, and repository metadata

the MIT license preserves your copyright notice, but it still allows reuse

if you want stronger control than MIT provides, move to a stricter license before broad distribution

License

MIT. See LICENSE.

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Cross-platform defensive security platform for identity exposure detection, breach intelligence, phishing analysis, and privacy-risk reporting.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	digital-identity-protection-system - Cross-platform defensive security platform for ide
所属分类	防护思路
发布作者	admin
发布时间	2026-10-06 00:28:15
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	156
讨论数量	0
主题状态	正常讨论中