SARAHAI-EDGE

Overview
SARAHAI-VPNv1.2 ("SARAHAI-EDGE") is an advanced VPN behavior monitoring and anomaly detection system designed for enterprises with large remote/hybrid workforces. It helps protect distributed environments by identifying VPN session anomalies, geo-velocity violations, and suspicious patterns.
🔍 Why SARAHAI-EDGE?
✅ Proactive VPN Security – Detect compromised VPN sessions in real-time
✅ Advanced PoL Behavior Profiling – Identify deviations from normal user patterns
✅ Geo-Velocity Monitoring – Prevent impossible travel-based identity theft
✅ SIEM Integration – Seamlessly reports threats to SARAHAI-SIEM
✅ Edge Processing for Windows 11 – Lightweight and optimized for minimal system impact
________________________________________
2️⃣ Features & Functionality
Feature Functionality Value to Enterprise
VPN Session Monitoring Tracks all active VPN sessions, login times, durations, and IPs Identifies unusual behavior and prevents unauthorized VPN access
Geo-Velocity Anomaly Detection Analyzes impossible travel speeds between login locations Detects stolen credentials and hijacked VPN sessions
Kernel Density Estimation (KDE) for Pattern of Life (PoL) Profiling Learns user login behavior over time to detect suspicious deviations Reduces false positives and enhances SOC efficiency
Data Exfiltration Alerts Identifies unusually large data transfers over VPN Prevents insider threats and external attacks
Edge-Based Processing Runs efficiently on-device without requiring cloud computation Minimal performance impact while ensuring continuous monitoring
SIEM Integration Sends real-time alerts to SARAHAI-SIEM for incident response Enables automated correlation and enterprise threat hunting
Automated Self-Installation of Dependencies Installs all required Python modules on first execution Eliminates setup errors for security teams
Stealth Mode (Daemon Process) Runs silently in the background without user interaction Ensures continuous VPN security without disrupting workflows