Week 10-11: CTF Challenge & Detector Development for AEGIS Framework

.github/workflows/test.yml

@@ -9,6 +9,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    env:
+      LLM_PROVIDER: mock
 
     steps:
     - uses: actions/checkout@v4

.gitignore

@@ -75,7 +75,7 @@ google-credentials.json
 SECURITY_BUGS_REPORT.md
 
 
-.node_modules/
+node_modules/
 
 # SQLite databases
 *.db

docs/aegis_architecture.md

@@ -0,0 +1,144 @@
+# AEGIS Architecture
+
+## Overview
+
+AEGIS (Agentic Expedition Guard & Intervention System) is a comprehensive security framework designed to protect agentic AI systems from the OWASP Agentic AI Security Top 10 vulnerabilities. The system provides real-time monitoring, detection, and mitigation capabilities specifically tailored for autonomous AI agents.
+
+## Architectural Pillars
+
+AEGIS is built upon four core pillars that work in concert to provide comprehensive security:
+
+### 1. Monitoring & Telemetry
+Continuous collection and analysis of agent behaviors, interactions, and system states to establish baselines and detect anomalies.
+
+### 2. Detection Engine
+Specialized detectors that identify specific attack patterns corresponding to OWASP ASI vulnerabilities using signature-based, anomaly-based, and heuristic approaches.
+
+### 3. Intervention & Response
+Automated and manual response mechanisms that can contain, mitigate, and remediate detected security incidents.
+
+### 4. Adaptive Learning
+Machine learning components that continuously improve detection accuracy and adapt to emerging threats based on observed patterns.
+
+## Data Flow
+
+```
+[Agent Actions] → [Telemetry Collector] → [Event Normalizer] → 
+[Detection Engine] ← [Threat Intelligence] → [Response Coordinator] 
+                                    � ↓
+                            [Intervention Mechanisms] → [Protected Agents]
+                                    � ↓
+                            [Feedback Loop] → [Adaptive Learning] → [Detection Updates]
+```
+
+## Core Components
+
+### Telemetry Collector
+- Agents all agent actions, interactions, and state changes
+- Normalizes data from diverse agent frameworks and protocols
+- Maintains temporal context for correlation analysis
+- Provides secure transmission to central analysis engine
+
+### Detection Engine
+- Modular detector plugins for each OWASP ASI vulnerability
+- Real-time stream processing of telemetry data
+- Configurable detection thresholds and sensitivity
+- Multi-stage detection gates for reduced false positives
+
+### Response Coordinator
+- Evaluates detection confidence and potential impact
+- Selects appropriate intervention strategies
+- Coordinates automated responses or alerts human analysts
+- Tracks incident response effectiveness
+
+### Intervention Mechanisms
+- Agent behavior modification (throttling, redirection)
+- Session termination or isolation
+- Permission restriction or elevation blocking
+- Deceptive response injection (for research/analysis)
+- Administrative alerting and ticket creation
+
+### Adaptive Learning System
+- Continuous model retraining with new threat data
+- False positive/negative analysis and correction
+- Emerging threat pattern recognition
+- Detector effectiveness optimization
+
+## Security Zones
+
+AEGIS implements a zero-trust architecture with clearly defined security zones:
+
+1. **Agent Zone**: Where AI agents operate and execute tasks
+2. **Monitoring Zone**: Where telemetry is collected and preprocessed
+3. **Analysis Zone**: Where detection engines operate on normalized data
+4. **Response Zone**: Where security interventions are coordinated and executed
+5. **Management Zone**: Where security policies are configured and analyzed
+
+## Integration Points
+
+AEGIS is designed to integrate with existing agentic AI systems through:
+
+- **Agent SDK Hooks**: Language-specific SDKs for inserting monitoring points
+- **API Gateways**: REST and gRPC interfaces for external agent systems
+- **Message Brokers**: Integration with common messaging systems (Kafka, RabbitMQ, etc.)
+- **Plugin Framework**: Extensible detector and response plugin architecture
+- **Webhook Support**: HTTP callbacks for external SIEM and SOAR systems
+
+## Deployment Models
+
+AEGIS supports multiple deployment architectures to suit different organizational needs:
+
+### Centralized Deployment
+All components deployed in a central location with agents connecting via secure channels.
+
+### Distributed Deployment
+Detection and response capabilities deployed closer to agent clusters for reduced latency.
+
+### Hybrid Deployment
+Critical components centralized with edge components deployed near agent populations.
+
+### Cloud-Native Deployment
+Fully containerized deployment using Kubernetes orchestration for scalability.
+
+## Scalability & Performance
+
+AEGIS is designed to handle high-volume agent interactions through:
+
+- Horizontal scaling of telemetry collectors
+- Stream processing technologies (Apache Kafka, Apache Pulsar)
+- Microservices architecture for independent scaling
+- Caching layers for frequently accessed data
+- Asynchronous processing pipelines
+- Load balancing and auto-scaling groups
+
+## Security Considerations
+
+AEGIS itself is secured through:
+
+- Mutual TLS authentication between components
+- Role-based access control for management interfaces
+- Audit logging of all security-relevant actions
+- Regular security penetration testing
+- Secure secret management for credentials and keys
+- Immutable infrastructure principles for deployment components
+
+## Extensibility
+
+AEGIS is designed for easy extension to address emerging threats:
+
+- Plugin architecture for new detector types
+- Configuration-driven detection rules
+- Custom response action definitions
+- Integration hooks for third-party threat intelligence
+- Template-based report generation
+- API for custom dashboard and visualization development
+
+## Compliance & Standards
+
+AEGIS aligns with industry standards and frameworks:
+
+- OWASP Agentic AI Security Top 10 (ASI01-ASI10)
+- NIST AI Risk Management Framework
+- ISO/IEC 42001 AI Management System
+- SOC 2 Type II for security and availability
+- GDPR considerations for data handling and privacy