1946-ma/shadow-it-detection

AI-Driven Shadow IT Detection Framework - BSc Cybersecurity Final Year Project, UMaT Tarkwa Ghana. Isolation Forest on CICIDS2017 dataset. # AI-Driven Shadow IT Detection Framework > BSc Cybersecurity Final Year Project · University of Mines and Technology (UMaT), Tarkwa, Ghana > Algorithm: Isolation Forest (scikit-learn) · Stack: Python · Flask · React.js · PostgreSQL > Dataset: CICIDS2017 — 8 real-world network traffic captures (~3.1 million flows) --- ## Prerequisites Install these before proceeding: | Tool | Version | Download | |---|---|---| | Python | **3.11 or 3.12** (not 3.13/3.14) | python.org | | Node.js | 18 LTS | nodejs.org | | PostgreSQL | 15, 16, or 17 | postgresql.org | | Git | any | git-scm.com | | Npcap | latest | npcap.com *(Windows only — required for Live Scan)* | > During Python installation, check **"Add Python to PATH"**. > During PostgreSQL installation, note your `postgres` user password — you will need it in Step 3. > During Npcap installation, check **"Install Npcap in WinPcap API-compatible Mode"**. --- ## Setup (run steps in order) ### 1. Clone the repository ```bash git clone github.com cd shadow-it-detection ``` --- ### 2. Install Python dependencies ```bash pip install -r requirements.txt ``` This installs Flask, psycopg3, scikit-learn, pandas, PyJWT, bcrypt, and Scapy. --- ### 3. Configure environment ```bash cp .env.example .env ``` Open `.env` and fill in your values: ``` DB_HOST=localhost DB_PORT=5432 DB_NAME=shadow_it_db DB_USER=shadow_it_app DB_PASSWORD=sh4d0w_app_2026 JWT_SECRET=shadow-it-umat-2026-super-secret-key JWT_EXPIRY_HOURS=8 FLASK_ENV=development FLASK_PORT=5000 ``` > The app connects as the restricted `shadow_it_app` role (created in Step 4b), not the `postgres` superuser. This enforces least-privilege access. --- ### 4a. Set up the database schema Ensure PostgreSQL is running, then run as the `postgres` superuser: ```bash python db/setup.py ``` This creates the `shadow_it_db` database, all …