An enterprise-grade, real-time Data Loss Prevention (DLP) desktop suite designed to monitor, intercept, and mitigate potential data leaks. Powered by a machine learning model, secure cryptographic quarantine mechanisms, active network packet sniffing, HTTP endpoint inspection, and USB activity monitoring.
- 📂 Real-time File System Auditing: Watches target folders recursively for file changes (creation/modification).
- 🧠 Machine Learning Classification: Uses a Logistic Regression classifier (
sensitive_data_model.pkl) to identify sensitive data (passwords, credit cards, SSNs) and distinguish it from safe text content. - 🔒 Cryptographic Quarantine: Automatically encrypts intercepted threats via AES-256 (
Fernet) and moves them to a secure.encfolder while safely destroying the insecure original. - 🔌 USB Activity Tracker: Hooks directly into Windows WMI events to log and alert on USB storage device insertion and removal.
- 📡 Active Network Sniffer: Captures TCP network packets using Scapy, extracting raw payloads to identify leaked sensitive keywords or ML-flagged content.
- 🌐 HTTP POST Endpoint: Runs a built-in server on
localhost:8080to intercept and analyze external HTTP POST requests (e.g., username/password leaks). - 📂 SQLite Persistence: Saves all security incidents, system logs, and detections in a local SQLite database (
dlp_logs.db) for historical analysis. - 🎨 Premium GUI Layout: Built using CustomTkinter with a dark mode dashboard, live metrics counters, tabs, and an interactive real-time logger.
- Python 3.12+
- GUI Engine: CustomTkinter / Tkinter
- File System Monitoring: Watchdog
- Cryptography: Cryptography (
Fernet) - Network Sniffing: Scapy
- WMI Integrations: Python WMI / Pywin32
- Machine Learning: Scikit-Learn / Joblib
-
Clone the Repository:
git clone <YOUR_REPOSITORY_URL> cd dlp_tool
-
Install Dependencies: Ensure you run the application using Python (having administrator/root privileges is required on Windows to run network sniffing and WMI events):
pip install watchdog cryptography customtkinter scapy wmi pywin32 joblib scikit-learn
-
Install WinPcap/Npcap: To capture live network traffic, you must have Npcap installed on your Windows machine.
Launch the main panel with:
python dlp.py- Click Start File Monitor and select a folder to audit.
- Any files containing sensitive data will trigger a warning. They will be encrypted using
secret.keyand isolated in thequarantine/directory, and the original will be securely deleted.
- Go to the USB & Encryption Tools tab.
- Click Select and Decrypt Quarantine File, pick your
.encfile, choose thesecret.keyfile from the project directory, and select a target output location to restore the original plaintext.
- Select your active network adapter from the dropdown (or leave it as
Auto-detect). - Adjust the hit threshold trigger.
- Click Start Sniffer to capture live payloads. Click Stop Sniffer to cleanly halt capture loops.
- Real-time logging outputs to the dashboard logger.
- You can query history by running:
python view_logs.py
├── dlp.py # Main application entry point & GUI
├── train_model.py # Pre-trained ML model setup script
├── test_model.py # Prediction test suite
├── view_logs.py # SQLite logs history utility
├── sensitive_data_model.pkl # Pre-trained ML classification pipeline
├── secret.key # AES-256 Fernet key (auto-generated)
├── dlp_logs.db # SQLite local database (auto-generated)
└── .gitignore # Excludes keys, logs, and build files
Do not commit secret.key or dlp_logs.db to version control. These files are excluded in .gitignore by default to ensure local data confidentiality.