Bharat Shield
Threat Intelligence Engine
Built overnight after a black-hat SEO malware injection silently defaced enterprise-packaging-client.internal. Bharat Shield is a full SOC/SIEM platform with an 8-module monitoring suite, 3-LLM consensus threat engine, and an Active IPS that auto-bans attackers in under 5 minutes.
A silent breach that destroyed search rankings overnight.
In 2026, an Enterprise Sustainable Packaging Manufacturer operating enterprise-packaging-client.internal suffered a sophisticated black-hat SEO malware injection. Attackers exploited a vulnerable WordPress plugin to silently inject hundreds of casino, pharma, and crypto spam links directly into rendered DOM nodes - hidden from admin views using display:none and opacity:0 CSS rules, but fully crawled by Googlebot.
The result was devastating: organic keyword rankings collapsed, Google flagged the domain as compromised, indexing status deteriorated, and six months of SEO equity was wiped out in days. Standard WordPress security plugins failed to detect DOM-level hidden injection. Standard admin views showed nothing.
The core vulnerability: visual attacks hide from code-level audits.
Standard security scanners inspect source code. The malware lived in rendered browser DOM - invisible to server-side tools, visible only via headless browser screenshot comparison.
Three engineering decisions that contained the breach.
Playwright DOM visual diff as the detection core.
Standard security tools missed the attack entirely. The breakthrough insight: malware living in rendered DOM is detectable only via full-browser screenshot comparison. Arivu deployed Playwright Chromium headless to capture 1920×1080 full-page screenshots with 3-pass scroll for lazy-loaded content, then integrated OpenCV SSIM to compute structural similarity scores every hour. SSIM < 0.80 fires a CRITICAL alert.
3-LLM consensus eliminates false positives.
Single-model AI threat analysis produces false positives that fatigue security operators. Bharat Shield routes every incident through a sequential 4-provider fallback chain: Gemini 2.5 Flash → Groq Llama-3.3-70B → Cerebras gpt-oss-120b → Mistral Large. Each provider produces structured Markdown incident reports covering root cause, risk assessment, immediate remediation steps, and long-term hardening.
Autonomous attacker IP banning via SSH.
Bharat Shield tails VPS access logs and auth logs in real-time via persistent Paramiko SSH sessions. Regex signatures detect SQL injection, XSS, and path traversal attacks. On HIGH/CRITICAL detection, Bharat Shield immediately SSH-executes a CSF or iptables DROP rule on the Linode VPS - banning the attacker's IP address before a human can review the alert. Total response time: 184 seconds.
Platform topology.
Every layer, documented.
Every module, every interval.
8 autonomous background monitoring modules run continuously at intervals from real-time SSH tailing down to 5-minute health pulses.
Uptime & Availability
Parallel HTTP probes across up to 50 monitored URLs. Any HTTP ≥ 400 or connection failure triggers CRITICAL Telegram alert instantly.
Client-Side Security & Malware
Fetches rendered HTML, scans for blackhat SEO keywords (casino, viagra, crypto), hidden DOM elements with spam links, and obfuscated JS (eval, base64_decode, String.fromCharCode).
WordPress File Integrity
SHA256 fingerprints of wp-config.php, .htaccess, index.php, wp-cron.php, wp-settings.php compared against stored baselines via Paramiko SSH to Linode VPS.
Visual Integrity Engine
Playwright Chromium headless renders 1920×1080 screenshots with 3-pass scroll, then OpenCV SSIM computes structural similarity. SSIM < 0.80 = CRITICAL defacement alert.
SEO Health Engine
13 automated checks: indexability, robots.txt, cloaking detection (Googlebot vs. visitor response comparison), title/meta tags, H1 structure, TTFB, HTTPS enforcement, sitemap.
Google Search Console
Service account API pulls clicks, impressions, CTR, avg position. Tracks 6 strategic commercial keywords for rank recovery. Detects spam terms in GSC impressions.
SSH Server Health Monitor
CPU/RAM/Disk metrics via Paramiko SSH. Monitors top 5 processes, web server status, active TCP connections, failed SSH login count (brute-force detection).
SIEM & Active IPS
Persistent SSH tail -F on VPS access.log + auth.log. Regex patterns for SQLi, XSS, path traversal. On HIGH/CRITICAL: auto-ban via CSF or iptables, Telegram push.
Real production code from Bharat Shield.
FastAPI endpoint routing threat payloads to a multi-LLM consensus pipeline and triggering automated containment via background tasks.
1from fastapi import FastAPI, BackgroundTasks2from core.multi_llm import multi_llm_evaluator3from core.ips import contain_incident45app = FastAPI(title="Bharat Shield SIEM v2")67@app.post("/v1/incidents/evaluate")8async def evaluate_threat(payload: dict, bg: BackgroundTasks):9 result = await multi_llm_evaluator(payload)10 if result.severity in ("HIGH", "CRITICAL"):11 bg.add_task(contain_incident, payload["asset_id"])12 bg.add_task(send_telegram_alert, result)13 return {"severity": result.severity, "sla_seconds": 184}11 SQLite tables. Complete audit trail.
Every monitoring module writes to its own dedicated SQLAlchemy ORM table. Full history is retained: scan results, alerts, SIEM events, file hashes, screenshots, keyword rankings, and GSC data.
100% AI analysis uptime, guaranteed.
Threat incidents are routed through a sequential provider waterfall. If any provider errors or times out, the next provider handles the request immediately - ensuring AI analysis never fails, even during provider outages.
Primary provider. Multimodal capability: can analyze pasted screenshots, raw attack payloads, and security logs.
First fallback. Ultra-fast inference via Groq LPU hardware. Handles high-volume threat analysis at sub-second speeds.
Second fallback. Cerebras Wafer-Scale Engine delivers near-instantaneous 120B parameter inference.
Final fallback. European-hosted AI ensuring multi-geography redundancy for critical incident analysis.
AI-Generated Incident Reports Include:
Dynamic Risk Score (0–100):
Computed in real-time from total alert volume, critical alert count, unique attacker IP count, and unresolved incident backlog. Displayed as a color-coded risk ring: SECURE (0–30) → ELEVATED (31–60) → HIGH RISK (61–80) → CRITICAL (81–100).
One dashboard. Full-spectrum SOC visibility.
Overview Tab
Built for zero false negatives.
Active IPS Auto-Banning
Detected threat IPs are autonomously blocked via CSF or iptables on the Linode VPS - no human review required for initial containment.
SSIM Visual Defacement Detection
Playwright headless screenshots compared via OpenCV SSIM every hour. Any visual change > 20% triggers CRITICAL alert - catches DOM injection invisible to code scanners.
Telegram Push + Desktop Toast
Multi-channel alert delivery: Telegram Bot API push with deduplication logic prevents alert storms. Win10toast desktop notifications for offline SOC operator monitoring.
WordPress File Integrity (SHA256)
wp-config.php, .htaccess, index.php, wp-cron.php, wp-settings.php fingerprinted every 30 minutes. Hash mismatch = immediate CRITICAL alert.
13-Point SEO Cloaking Detection
Dual HTTP requests: Googlebot UA vs. visitor UA. Detects cloaking via title mismatch, canonical discrepancy, HTML content length variance > 15%, or spam keyword injection to bots.
Alert Deduplication Engine
Before dispatching, the notification engine queries the DB for unresolved alerts from the same module and URL. Identical alerts within recent runs are suppressed to prevent operator fatigue.
Embedded, step-by-step response procedures.
Bharat Shield includes pre-built remediation playbooks tailored specifically for CyberPanel / OpenLiteSpeed / Linode VPS / WordPress environments - no manual research required during an incident.
- 1.Verify attacker IP auto-ban status in Active IPS
- 2.Inspect request parameters in raw SIEM log trace
- 3.Deactivate and delete vulnerable WordPress plugin
- 4.Run WP Integrity Check to ensure database/core integrity
- 1.Run immediate Visual Integrity scan at 1920×1080
- 2.Inspect hidden DOM elements via Playwright devtools
- 3.Remove malicious plugin, run WP malware scanner
- 4.Submit clean-site reconsideration request to Google Search Console
- 1.Verify active SSH key connection to Linode VPS
- 2.Set PasswordAuthentication no in /etc/ssh/sshd_config
- 3.Restart SSHD service, confirm CSF active IP ban list
- 4.Review journalctl -u sshd for attacker IP diversity
- 1.Verify attacker IP auto-ban status in IPS
- 2.Install Wordfence, run full malware scan
- 3.Add X-XSS-Protection and X-Content-Type-Options security headers via .htaccess
- 4.Audit all user-input fields for unescaped output