CyberMind-FR
8ef0c70d0f
Backend (secubox-iot-guard): - OUI-based device classification with 100+ IoT vendor prefixes - 10 device classes: camera, thermostat, lighting, plug, assistant, etc. - Risk scoring (0-100) with auto-isolation threshold - Anomaly detection: bandwidth spikes, port scans, time anomalies - Integration with Client Guardian, MAC Guardian, Vortex Firewall - iot-guardctl CLI for status/list/scan/isolate/trust/block - SQLite database for devices, anomalies, cloud dependencies - Traffic baseline profiles for common device classes Frontend (luci-app-iot-guard): - KISS-style overview dashboard with security score - Device management with isolate/trust/block actions - Vendor classification rules editor - Settings form for UCI configuration - RPCD handler with 11 methods - Public ACL for unauthenticated dashboard access Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
28 lines
701 B
JSON
28 lines
701 B
JSON
{
|
|
"class": "camera",
|
|
"description": "IP cameras, video doorbells, security cameras",
|
|
"expected_behavior": {
|
|
"bandwidth": {
|
|
"avg_kbps_in": 50,
|
|
"avg_kbps_out": 500,
|
|
"peak_kbps_out": 5000,
|
|
"continuous_stream": true
|
|
},
|
|
"activity_hours": "24/7",
|
|
"common_ports": [80, 443, 554, 8080, 8443],
|
|
"cloud_services": ["ring.com", "nest.com", "wyze.com", "eufy.com", "arlo.com"],
|
|
"protocols": ["http", "https", "rtsp", "rtmp"]
|
|
},
|
|
"risk_indicators": {
|
|
"high": [
|
|
"uploading_to_unknown_cloud",
|
|
"large_data_transfer_at_night",
|
|
"connection_to_foreign_ip"
|
|
],
|
|
"medium": [
|
|
"new_cloud_destination",
|
|
"port_change"
|
|
]
|
|
}
|
|
}
|