Multi-Agent Threat Detection System

Overview

This repo contains solution for one internal cybersecurity hackathon, where we must solve 5 tasks:

1. Password policy
   1. Problem: find UNIX and non-UNIX accounts with weak passwords and reset 'em
   2. Solution: search for UNIX and SMB accounts, supply their hashes to John The Ripper and change passwords if we can bruteforce them
2. Network policy
   1. Problem: find vulnerable services and close their external opened ports
   2. Solution: search for Dockerfile, docker-compose.yaml and .sh files, search for vulnerability in them using LLM and block it's ports
3. SAST
   1. Problem: find a project in python and fix vulnerabilities found in code
   2. Solution: search for a project was implemented as algorythm, search and fix problems implemented using semgrep
4. CVE-management
   1. Problem: find CVE in project dependencies from previous task and fix by updating vulnerable dependencies
   2. Solution: just supply requirements.txt to LLM and ask to fix vulnerable dependencies :)
5. Q/A-agent
   1. Problem: given multiple documents, answer multiple questions using document data.
   2. Solution: pass documents to chromadb to build and index. If LLM chooses to search in index, then pass question to index and repeatedly ask LLM for an answer using given data from index.

For each problem solution was written using langchain_openai and langgraph libraries.
Some data sets, e.g. for track 5 RAG was deleted to avoid issues with NDA.

How to Run

0. Upgrade pip

pip install --upgrade pip

1. Install dependencies:

# Install dependencies
pip install -r requirements.txt

2. Define a GIGACHAT_TOKEN env variable.

   1. If using Gemini define GEMINI_API_KEY

3. (Optional) Install RU government certificates for GigaChat

# 1. Скачиваем сертификат
Invoke-WebRequest -Uri "https://gu-st.ru/content/lending/russian_trusted_root_ca_pem.crt" -OutFile "russian_trusted_root_ca_pem.crt"

# 2. Находим путь к cacert.pem из пакета certifi
$certifiPath = python -c "import certifi; print(certifi.where())"

# 3. Добавляем сертификат к списку доверенных
Get-Content "russian_trusted_root_ca_pem.crt" | Add-Content $certifiPath

4. Run

python -m src.track1-password-policy.main

Free LLM

• Together.ai https://docs.together.ai/docs/rate-limits (60 RPM)

LangChain vs LangGraph

LangGraph basically like langchain, but:

• Simplifies to run AI-agents asynchronously
  • Allows merge results from step before
• Supports conditional node

All this can be obtained using langchain, but with more code complexity n requires higher threshold for new developers to entry into project.

Contribution

• Update requirements.txt

pipreqs . --force --encoding=UTF8 --ignore ".venv"

Contributors:

• https://github.com/ratedRRu (track 3)
• https://github.com/fresh-fx59 (track 2 & 5)