🛡️ WorkGuard AI

AI-Powered Unauthorized Access Detection & Workspace Security Monitor

---

🎯 The Problem

Every day, employees leave their workstations unlocked — for a meeting, a coffee break, or an emergency. In those few unattended minutes, sensitive data can be accessed, files can be copied, and credentials can be stolen.

Traditional solutions? Either too complex (IT-configured software) or too passive (just a screensaver lock). Neither detects who used the machine while you were away, what they did, or when it happened.

WorkGuard AI solves this.

It runs silently in the background, learns your unique behavioral fingerprint, and the moment someone else touches your keyboard — it knows.

---

📸 Screenshots

🖥️ Terminal — System Startup

📊 Live Monitoring Dashboard

📷 Camera Surveillance Bar

📈 App Usage Analytics

---

✨ Key Features

Feature	Description
⌨️ Keystroke Capture	Every keypress logged with millisecond-precision timing
🧬 Biometric Fingerprinting	Builds unique typing profile using dwell & flight time
🤖 ML Anomaly Detection	Isolation Forest detects behavioral deviations in real-time
📷 Camera Surveillance	OpenCV monitors desk presence — detects owner vs stranger
🔐 AES-256-GCM Encryption	All logs encrypted at rest with tamper detection
📊 Live Dashboard	Real-time Flask API + Chart.js — no refresh needed
🖱️ Mouse Tracking	Clicks, scrolls, movement patterns recorded
📸 Auto Screenshots	Periodic visual evidence every 30 seconds
🚨 Instant Alerts	Desktop notification fires on unauthorized access
📝 Session Reports	Full HTML report generated at end of each session

---

🏗️ System Architecture

┌─────────────────────────────────────────────────────────┐
│                     WorkGuard AI                        │
├─────────────────────────────────────────────────────────┤
│                                                         │
│   ┌─────────────┐    ┌─────────────┐    ┌───────────┐  │
│   │   CAPTURE   │    │  ML ENGINE  │    │    API    │  │
│   │             │    │             │    │           │  │
│   │ • Keyboard  │───▶│ • Biometrics│───▶│ • Flask   │  │
│   │ • Mouse     │    │ • Isolation │    │ • 8 REST  │  │
│   │ • Camera    │    │   Forest    │    │   endpoints│  │
│   │ • Screenshot│    │ • Z-score   │    │ • SSE     │  │
│   └─────────────┘    └─────────────┘    └─────┬─────┘  │
│                                               │        │
│   ┌─────────────┐    ┌─────────────┐          │        │
│   │  SECURITY   │    │  DASHBOARD  │◀─────────┘        │
│   │             │    │             │                   │
│   │ • AES-256   │    │ • Chart.js  │                   │
│   │ • GCM Auth  │    │ • Live Feed │                   │
│   │ • Encrypted │    │ • Threat    │                   │
│   │   Logs      │    │   Gauge     │                   │
│   └─────────────┘    └─────────────┘                   │
└─────────────────────────────────────────────────────────┘

workguard_ai/
├── core/
│   ├── recorder.py       # Event capture engine
│   ├── camera.py         # OpenCV camera surveillance
│   ├── encryptor.py      # AES-256-GCM encryption
│   └── alerts.py         # Alert system
├── ml/
│   ├── biometrics.py     # Keystroke dynamics engine
│   └── anomaly.py        # Isolation Forest detector
├── api/
│   └── server.py         # Flask REST API
├── dashboard/
│   └── index.html        # Live monitoring dashboard
├── main.py               # Main orchestrator
└── requirements.txt

---

🧠 How the ML Works

Layer 1 — Keystroke Dynamics Biometrics

Every person types differently. WorkGuard AI captures your unique typing fingerprint:

Key Press ──────────────────────────────── Key Release
    │◄──────── Dwell Time (ms) ──────────►│

Key Release ──────────────── Next Key Press
    │◄──── Flight Time (ms) ────►│

Profile building:

• Captures 50+ keystrokes during calibration
• Computes mean & standard deviation of dwell/flight times
• Stores typing WPM and rhythm variance

Similarity scoring (Z-score method):

Z = |current_value - profile_mean| / profile_std
Similarity = e^(-0.5 × Z²)

Score ≥ 0.65 → Original User ✅
Score < 0.65 → Unknown User ⚠️

Research basis: Carnegie Mellon University Keystroke Dynamics Dataset

---

Layer 2 — Isolation Forest Anomaly Detection

Uses scikit-learn's Isolation Forest — an unsupervised ML algorithm that learns what "normal" looks like and flags deviations.

9-dimensional feature vector per session window:

Feature	What it measures
kpm	Keystrokes per minute
mean_dwell	Average key hold duration
mean_flight	Average inter-key latency
dwell_variance	Typing consistency
click_rate	Mouse clicks per minute
scroll_rate	Scroll events per minute
hour_of_day	Unusual login times (2AM?)
special_key_ratio	Ctrl/Alt/Win usage (hackers use more)
unique_windows	Number of different apps opened

Why Isolation Forest?

• Unsupervised — no labeled "attack" data needed
• Works with small datasets (your own sessions)
• O(n log n) — fast enough for real-time use
• Industry standard for behavioral anomaly detection

---

Layer 3 — Camera Surveillance (OpenCV)

3-State Finite State Machine:

┌─────────────────┐     user leaves      ┌──────────────┐
│  OWNER_PRESENT  │─────────────────────▶│   NO_ONE     │
│   (Safe mode)   │                      │ (Standby)    │
└────────┬────────┘                      └──────┬───────┘
         ▲                                      │ stranger arrives
         │ owner returns                        ▼
         │                              ┌──────────────┐
         └──────────────────────────────│   STRANGER   │
                                        │  🔴 ALERT!   │
                                        └──────────────┘

• Haar Cascade face detection (built into OpenCV)
• Smoothing buffer — requires 3 consecutive detections before state change (prevents false alerts)
• Intruder photo captured automatically on STRANGER detection

---

🔐 Security Architecture

Password
   │
   ▼
SHA-256 Hash ──▶ 256-bit Key
                     │
                     ▼
              ┌─────────────────────────┐
              │  For each log chunk:    │
              │  • Generate 96-bit nonce│
              │  • AES-256-GCM encrypt  │
              │  • Append auth tag      │
              │  • Write to .enc file   │
              └─────────────────────────┘

Property	Value
Algorithm	AES-256-GCM
Key size	256 bits
Nonce	96-bit (random per chunk)
Auth tag	128-bit (tamper detection)
Key derivation	SHA-256

---

🚀 Quick Start

# 1. Clone the repository
git clone https://github.com/reshma-adsul/WorkGuard-AI-.git
cd WorkGuard-AI-

# 2. Run (auto-installs all dependencies)
python main.py

First-time setup:

Enable AES-256 encryption? → y (recommended) or n
Screenshot interval?       → 30 (default)
Launch live dashboard?     → y
Enable camera?             → y
Register your face?        → y (look at camera)

Then:

1. Type normally for 2+ minutes
2. Click "🎯 Calibrate" in dashboard
3. Your behavioral profile is saved!
4. Use START_SILENT.bat before leaving your desk next time

Dashboard: http://127.0.0.1:5000

---

🌐 REST API Reference

Endpoint	Method	Description
/api/status	GET	Session info, calibration state
/api/live	GET	Last N events from buffer
/api/live/stream	GET	SSE stream (real-time push)
/api/stats	GET	Aggregated session statistics
/api/biometric/score	GET	Real-time biometric similarity
/api/anomaly/score	GET	Isolation Forest prediction
/api/calibrate	POST	Build user behavioral profile
/api/camera/status	GET	Camera surveillance state
/api/sessions	GET	List all past sessions

---

🧪 Tech Stack

Layer	Technology	Why
Event Capture	pynput	OS-level hooks — works across all apps
Screenshots	PIL ImageGrab	Lightweight, no dependencies
Window Tracking	win32gui, psutil	Native Windows API
Computer Vision	OpenCV	Industry standard, no internet needed
ML — Biometrics	NumPy, statistics	Lightweight statistical modeling
ML — Anomaly	scikit-learn	IsolationForest, production-ready
Encryption	cryptography	AES-256-GCM, NIST approved
Backend	Flask, flask-cors	Lightweight REST API
Frontend	Vanilla JS, Chart.js	Zero build process, fast
Alerts	plyer, smtplib	Cross-platform desktop + email

---

📋 Requirements

pynput>=1.7.6
Pillow>=10.0.0
pywin32>=306
psutil>=5.9.0
flask>=3.0.0
flask-cors>=4.0.0
cryptography>=41.0.0
scikit-learn>=1.3.0
numpy>=1.24.0
opencv-python>=4.8.0
plyer>=2.1.0

---

⚠️ Ethical Use

This tool is intended only for:

• Monitoring your own device
• Enterprise endpoint security with employee consent
• Academic research in behavioral biometrics

Unauthorized monitoring is illegal. Do not use on devices you do not own.

---

👩‍💻 Author

Reshma Adsul

---

📄 License

MIT License — free to use, modify, and distribute with attribution.