EGIES-AUTO: Autonomous Self-Healing Security System

Abstract

Cyberattacks are becoming more frequent and sophisticated, and traditional antivirus software is often too slow or ineffective to detect and prevent new threats. Many security setups today still rely on human intervention. The delay this creates gives attackers a window to do serious damage. This shows how important it is to have a system that can detect and neutralize threats automatically, without waiting for human intervention. This paper presents AEGIES-AUTO, an autonomous security system capable of detecting and eliminating cyber threats in real time without any human involvement. The system operates in real time, monitoring all active processes and network connections on a host machine, and responds instantly when it detects suspicious behaviour, such as a reverse shell, a malicious process, or unusual port activity. Its response sequence terminates the offending process, blocks the associated ports, generates a forensic backup of the threat data for subsequent review, captures a screenshot as evidence, and sends instant alerts via email, desktop notifications, and voice messages, all within seconds of detection. AEGIES-AUTO is implemented in Python and provides a web-based dashboard showing live security metrics, threat history, and overall system health. It also features whitelist management to prevent false positives, a quarantine directory for isolating suspicious files and structured report generation for organised documentation. What makes AEGIES-AUTO different from traditional tools is the combination of speed and true autonomy: it doesn't wait for a human response, so threats are neutralised immediately upon detection. The system is realistic security for students, individual users and small organisations that cannot justify the cost of commercial security subscriptions, being lightweight, easy to deploy and free of licensing costs. In summary, AEGIES-AUTO demonstrates that effective, autonomous, real-time threat response can be achieved without the overhead normally associated with enterprise-grade security platforms