ARGUS is a unified cyber intelligence platform designed for high-risk environments including Finance, Defense, External Affairs, and Public Administration. It monitors emails, URLs, communication streams, and video content in real-time to detect AI-driven threats, explain risk evidence, and recommend mitigation actions before escalation.

Unlike generic security tools, ARGUS delivers deep threat intelligence through multi-vector analysis with persistent graph-based memory. The platform combines browser-side telemetry, AI-assisted classification, real-time deepfake detection, and knowledge graph correlation into a single integrated defense system.

ARGUS provides an integrated, explainability-first defense platform:

• Multi-Vector Threat Detection — Unified analysis of URLs, emails, video content, and AI prompts
• Real-Time Deepfake Analysis — Frame-by-frame video forensics with face detection and temporal tracking
• Knowledge Graph Intelligence — Neo4j-powered relationship mapping to correlate threats into campaigns
• Explainable AI Decisions — Every detection includes evidence trails, confidence scores, and recommended actions
• Browser-Native Protection — Chrome extension monitors browsing activity and blocks threats in real-time

ARGUS monitors six distinct threat vectors through a unified detection engine:

The deepfake detection engine uses a dual-signal approach that works with or without visible faces:

Face-Based Analysis

• MTCNN face detection extracts facial regions from video frames
• PyTorch neural network evaluates face authenticity
• EfficientNet backbone provides robust feature extraction

Forensic Frame Analysis

• Compression artifact detection identifies manipulation signatures
• Temporal consistency tracking across consecutive frames
• Rolling confidence averaging for stable verdicts

Output Signals

• Fake probability (0-100%)
• Confidence level (REAL / FAKE / UNCERTAIN)
• Stability score across frame sequence
• Processing time metrics

Every threat detection includes four layers of explainability:

Neo4j-powered relationship mapping connects individual detections into campaign-level intelligence:

Node Types

• Users, Domains, IP Addresses, Organizations, Threats, Attack Campaigns

Relationship Tracking

• User visited domain patterns
• Threat correlation across domains
• Campaign clustering by shared infrastructure
• Brand impersonation detection

Campaign Detection

• Automatic clustering by shared IP, registrar, or target brand
• Attack pattern recognition across multiple indicators
• Threat actor attribution support

The Chrome extension (Manifest V3) provides real-time protection during browsing:

Active Monitoring

• Navigation event interception
• Email interface scanning (Gmail, Outlook)
• AI chat interface monitoring
• Form submission tracking

Threat Response

• In-page warning overlays for suspicious content
• Full-page blocks for malicious domains
• Real-time deepfake analysis via popup controls
• Backend connection status and configuration

User Interface

• Popup dashboard with threat module status
• Configurable backend URL
• Dark/light theme support
• Session event tracking

ARGUS is architected for high-risk public sector operations:

┌─────────────────────────────────────────────────────────────────┐
│                     BROWSER EXTENSION                           │
│  Manifest V3 | Service Worker | Content Scripts | Popup UI     │
│  ┌──────────────┐ ┌──────────────┐ ┌──────────────┐            │
│  │     URL      │ │    Email     │ │   Deepfake   │            │
│  │   Monitor    │ │   Scanner    │ │   Capture    │            │
│  └──────────────┘ └──────────────┘ └──────────────┘            │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                    ARGUS WEB PLATFORM                           │
│  Next.js 16 + React 19 + NextAuth + Tailwind CSS               │
│  ┌──────────────┐ ┌──────────────┐ ┌──────────────┐            │
│  │  Dashboard   │ │  Knowledge   │ │  Analytics   │            │
│  │   & Alerts   │ │    Graph     │ │   Reports    │            │
│  └──────────────┘ └──────────────┘ └──────────────┘            │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                      API & AI LAYER                             │
│  ┌──────────────┐ ┌──────────────┐ ┌──────────────┐            │
│  │  URL/Email   │ │   Prompt     │ │   Gemini     │            │
│  │  Analysis    │ │  Injection   │ │ Explanation  │            │
│  └──────────────┘ └──────────────┘ └──────────────┘            │
└─────────────────────────────────────────────────────────────────┘
                              │
            ┌─────────────────┼─────────────────┐
            ▼                 ▼                 ▼
┌───────────────────┐ ┌───────────────┐ ┌───────────────┐
│   FLASK BACKEND   │ │    MongoDB    │ │     Neo4j     │
│  ┌─────────────┐  │ │               │ │               │
│  │   MTCNN     │  │ │  Analytics    │ │   Knowledge   │
│  │  Detection  │  │ │  Threat Logs  │ │     Graph     │
│  │  PyTorch    │  │ │  User Data    │ │   Campaigns   │
│  │  Forensics  │  │ │               │ │               │
│  └─────────────┘  │ │               │ │               │
└───────────────────┘ └───────────────┘ └───────────────┘

1. Browser Capture — Extension monitors navigation, emails, video content, and AI chats
2. API Analysis — Next.js routes process threats with Gemini AI classification
3. Deepfake Processing — Flask backend performs frame-level video forensics
4. Storage — MongoDB stores analytics and logs; Neo4j builds relationship graph
5. Visualization — Dashboard displays real-time alerts, graphs, and trend analysis

The security dashboard provides real-time visibility into threat activity:

• Server-Sent Events — Live detection results stream to connected dashboards
• Probability History — Rolling visualization of deepfake confidence over time
• Risk Distribution — Breakdown of safe, low, medium, high, and critical detections
• Timeline Analysis — Daily aggregation of interactions and threats
• Top Risky Domains — Ranked list of suspicious domains by risk score

Comprehensive analytics across all detection types:

• Total interactions and unique domains tracked
• Threats detected with severity breakdown
• Active campaign identification
• Brand impersonation attempts
• Historical trend monitoring

Automatic enrichment for analyzed domains:

• WHOIS Data — Domain age, registrar, creation/expiration dates
• DNS Records — IP addresses, nameservers
• Geolocation — Country, region, city, coordinates
• Hosting Provider — Infrastructure identification
• Brand Impersonation — Fuzzy matching against known brands
• Risk Scoring — Composite score based on multiple factors

Five-layer anonymization for privacy-compliant graph storage:

1. DROP — Remove PII fields (email, name, password, content)
2. HASH — SHA-256 hash of IPs, domains, device IDs
3. BUCKET — Timestamp bucketing, geolocation generalization
4. KEEP — Preserve threat metadata (verdict, severity, source)
5. ADD — Synthetic IDs, anonymization flags, retention metadata

Merkle tree implementation for detection audit trails:

• Tamper-proof event logging
• Verifiable threat history
• Integrity verification for compliance

• Node.js 20+ and npm
• Python 3.9+
• MongoDB (local or Atlas)
• Neo4j (optional, for graph features)
• Google Gemini API key

cd argus/ARGUS
npm install
npm run dev

Access at: http://localhost:3000

cd argus/backend

# Create virtual environment
python -m venv venv

# Activate (Windows)
venv\Scripts\activate

# Activate (macOS/Linux)
source venv/bin/activate

# Install dependencies
pip install -r requirements.txt

# Run server
python server.py

Access at: http://localhost:5000

1. Open Chrome and navigate to chrome://extensions/
2. Enable "Developer mode" (toggle in top-right)
3. Click "Load unpacked"
4. Select the argus/extension directory
5. Click extension icon and verify backend URL is http://localhost:5000

cd argus/ARGUS
npm run init-graph
npm run test-graph

Create ARGUS/.env.local:

# Authentication
NEXTAUTH_SECRET=your_long_random_secret_here
NEXTAUTH_URL=http://localhost:3000

# Google OAuth (optional)
GOOGLE_CLIENT_ID=your_google_client_id
GOOGLE_CLIENT_SECRET=your_google_client_secret

# MongoDB
MONGODB_URI=mongodb://127.0.0.1:27017/argus

# Neo4j Graph Database
NEO4J_URI=bolt://localhost:7687
NEO4J_USER=neo4j
NEO4J_PASSWORD=your_neo4j_password
NEO4J_DATABASE=neo4j

# Gemini AI
GEMINI_API_KEY=your_gemini_api_key

argus/
├── ARGUS/                      # Next.js web platform
│   ├── app/                    # Pages and API routes
│   │   ├── api/                # 20+ API endpoints
│   │   ├── dashboard/          # Security dashboard
│   │   ├── analytics/          # Analytics views
│   │   ├── knowledge-graph/    # Graph visualization
│   │   ├── assistant/          # AI assistant
│   │   └── profile/            # User management
│   ├── components/             # React components
│   ├── lib/                    # Utilities and models
│   │   ├── models/             # 10 MongoDB schemas
│   │   ├── auth-options.js     # NextAuth config
│   │   ├── mongodb.js          # Database connection
│   │   ├── neo4j.js            # Graph driver
│   │   ├── graph-builder.js    # Graph operations
│   │   ├── domain-enrichment.js # WHOIS/DNS/GeoIP
│   │   └── anonymizer.js       # PII protection
│   └── scripts/                # Utility scripts
│
├── backend/                    # Flask deepfake service
│   ├── server.py               # Flask application
│   ├── core/
│   │   ├── deepfake_detection.py
│   │   ├── face_detection.py
│   │   ├── frame_analysis.py
│   │   └── model.py
│   └── requirements.txt
│
├── extension/                  # Chrome extension
│   ├── manifest.json           # Manifest V3 config
│   ├── background.js           # Service worker
│   ├── content.js              # Primary content script
│   ├── content-interaction-tracker.js
│   ├── content-prompt-injection.js
│   ├── popup.html/js/css       # Extension popup
│   ├── overlay.html/js/css     # In-page warnings
│   ├── blocked.html            # Block page
│   └── analyzing.html          # Analysis progress
│
└── chatbot/                    # Optional chatbot module

ARGUS uses 10 MongoDB collections for operational data:

# ARGUS Platform
cd ARGUS
npm run dev          # Development server
npm run build        # Production build
npm run start        # Production server
npm run lint         # ESLint
npm run init-graph   # Initialize Neo4j schema
npm run test-graph   # Test graph connectivity
npm run diagnose     # Diagnose graph issues

# Backend Service
cd backend
python server.py     # Start Flask server

• Remove test endpoints (/api/test-db, /api/reset-graph)
• Implement strict CORS policies
• Enable HTTPS for all services
• Add rate limiting to public endpoints
• Rotate API keys regularly
• Implement centralized logging and monitoring

• bcryptjs password hashing (10 salt rounds)
• JWT session tokens (30-day expiry)
• NextAuth middleware protection
• Google OAuth integration support

• Re-run npm install inside ARGUS
• Verify .env.local exists with all required variables
• Check MongoDB connectivity

• Verify backend URL in popup settings
• Confirm backend/server.py is running
• Check service worker logs in chrome://extensions/

• Confirm Python environment has all packages from requirements.txt
• Verify model files are present
• Test /health endpoint first

• Validate Neo4j credentials in .env.local
• Run npm run init-graph to create schema
• Run npm run diagnose for detailed diagnostics

This project is proprietary software.