CyberMind-FR
8ef0c70d0f
Backend (secubox-iot-guard): - OUI-based device classification with 100+ IoT vendor prefixes - 10 device classes: camera, thermostat, lighting, plug, assistant, etc. - Risk scoring (0-100) with auto-isolation threshold - Anomaly detection: bandwidth spikes, port scans, time anomalies - Integration with Client Guardian, MAC Guardian, Vortex Firewall - iot-guardctl CLI for status/list/scan/isolate/trust/block - SQLite database for devices, anomalies, cloud dependencies - Traffic baseline profiles for common device classes Frontend (luci-app-iot-guard): - KISS-style overview dashboard with security score - Device management with isolate/trust/block actions - Vendor classification rules editor - Settings form for UCI configuration - RPCD handler with 11 methods - Public ACL for unauthenticated dashboard access Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
27 lines
604 B
JSON
27 lines
604 B
JSON
{
|
|
"class": "plug",
|
|
"description": "Smart plugs, outlets, switches",
|
|
"expected_behavior": {
|
|
"bandwidth": {
|
|
"avg_kbps_in": 0.5,
|
|
"avg_kbps_out": 1,
|
|
"peak_kbps_out": 10,
|
|
"continuous_stream": false
|
|
},
|
|
"activity_hours": "on_demand",
|
|
"common_ports": [443, 6668, 6669],
|
|
"cloud_services": ["tplinkcloud.com", "tuya.com", "wemo.com"],
|
|
"protocols": ["https", "mqtt"]
|
|
},
|
|
"risk_indicators": {
|
|
"high": [
|
|
"scanning_network",
|
|
"connection_to_unknown_ip",
|
|
"high_bandwidth"
|
|
],
|
|
"medium": [
|
|
"activity_at_unusual_hours"
|
|
]
|
|
}
|
|
}
|