CyberAI

A complete Agentic AI system for automated security analysis of domains and IP addresses, combining FastAPI, Celery, Redis, MongoDB, LangChain, and Gemini.

This project enables the execution of technical security scans (Shodan, Nmap, SSLyze) and leverages AI agents to analyze, summarize, and prioritize cybersecurity risks in an autonomous and intelligent way.

---

Objectifs du projet

• Automation: Drastically reduces technical audit time from hours to mere minutes.
• Simplification: Leverages AI (LLM) to translate complex technical vulnerabilities into clear, executive-friendly language.
• Centralization: Consolidates multiple security tools (Network Discovery, SSL/TLS, Vulnerabilities) into a single unified web interface.
• Interactivity: Provides a context-aware virtual assistant (Chatbot) capable of answering specific questions regarding detected threats.
• Design a scalable, agent-based architecture for cybersecurity automation

---

Major Benefits

• More than 98% time savings Automated scans and AI-driven analysis dramatically reduce manual effort.

• Fully autonomous workflow From scan execution to AI reporting, the process runs end-to-end without human intervention.

• 4-in-1 unified platform Nmap + Shodan + SSLyze + LLM Assistant integrated into a single solution.

• Reduced operational workload Security experts focus on critical remediation actions instead of repetitive analysis tasks.

• Earlier vulnerability detection Faster identification of security flaws helps prevent critical delays and limits risk exposure.

• Significant cost reduction Early detection and automation can save organizations up to ~$4.35 million in potential security breach costs.

---

Architecture globale

Diagramme de sequence

---

Stack technique

Backend

• FastAPI – API REST
• Celery – Background task execution and asynchronous job processing
• Redis – Message broker for task queue management
• MongoDB – NoSQL database for storing scan results and reports
• Motor – Asynchronous MongoDB driver for high-performance I/O operations

Intelligence Artificielle

• LangChain – Agent Orchestration
• Google Gemini (2.5 Flash) – LLM
• Personalized AI Assistants.

Cybersecurity Tools

• Shodan API – Identifies publicly exposed services and open ports
• Nmap – Performs network scanning and service discovery
• SSLyze – Analyzes TLS/SSL configurations and certificate security

Frontend

• React 18
• Vite
• Axios

DevOps

• Docker & Docker Compose

---

Implemented AI Agents

DiscoveryAgent

• Uses Shodan + Nmap
• Collects open ports, running services, and detected technologies

LLMAnalysisAgent

• Analyzes raw scan results
• Generates:
  • Executive (managerial) summary
  • Technical vulnerabilities
  • Security recommendations
  • Risk score

Extensible Agents

The system is designed to be easily extended with additional agents such as:

• VulnerabilityAgent (CVE detection)
• Risk Scoring Agent
• Compliance Agent (OWASP / ISO standards)

---

Scan Workflow

1. The user initiates a scan via the API
2. FastAPI sends the task to Redis
3. A Celery worker picks up the task
4. Technical scans are executed (Nmap / Shodan / SSLyze)
5. AI analysis is performed using LangChain
6. Results are stored in MongoDB
7. The frontend displays the results

---

Project Structure

agentic-ai-cyber/
├── backend/
│   ├── app/
│   │   ├── api/
│   │   ├── core/
│   │   ├── db/
│   │   ├── models/
│   │   └── main.py
│
├── worker/
│   ├── agents/
│   ├── tools/
│   └── tasks.py
│
├── frontend/
│   ├── src/
│   └── index.html
│
├── docker-compose.yml
└── README.md

---

---

Running the Project

1️⃣ Prerequisites

• Docker
• Docker Compose
• API keys:
  • GOOGLE_API_KEY
  • SHODAN_API_KEY

2️⃣ Environment Variables (.env)

GOOGLE_API_KEY=xxx
SHODAN_API_KEY=xxx
REDIS_URL=redis://redis_project:6379/0
MONGO_URI=mongodb://mongo_project:27017
MONGO_DB=agentic_ai_cyber

3️⃣ Launch

docker-compose up --build

---

Security

• JWT-based authentication

• Protected routes using Depends(get_current_user)

• Task isolation through Celery workers

---

Exemple de raisonnement Agentic (LangChain)

Thought: I need public info
Action: shodan_scan
Observation: ports 80, 443
Thought: confirm locally
Action: nmap_scan
Observation: ports confirmed
Final Answer: ...

---

Why LangChain?

• Intelligent tool orchestration

• Step-by-step reasoning (ReAct pattern)

• Modular and reusable agents

• Easy extensibility

---

---

License

This project is intended for educational and demonstrative purposes.

---

Author

Developed by Hasna ASBAI – Big Data & Information Systems Engineering

« An agentic architecture enables automating cybersecurity while maintaining intelligent and explainable analysis. »