feat(enrichers): add ip_to_security_risk — Shodan-backed weighted risk scoring for IP nodes

[adityaa206]

Summary

• Adds a new ip_to_security_risk enricher under flowsint-enrichers/src/flowsint_enrichers/ip/to_security_risk.py
• Takes an Ip node → queries Shodan → emits a RiskProfile node + Port nodes, all linked in the graph
• Adds shodan>=1.31,<2.0 to flowsint-enrichers dependencies

What problem does this solve?

Flowsint already excels at mapping entity relationships (domains, IPs, social accounts, etc.), but it has no native way to score the security danger of an IP node. An investigator looking at an IP in the graph has no immediate signal of how risky it is.

This enricher fills that gap: it enriches an IP with a 0–100 risk score, a critical / high / medium / low classification, CVE IDs, exposure-surface summary, compliance risk flags, and mitigation recommendations — all surfaced as a RiskProfile node linked directly to the IP.

Scoring model

Adapted from RedFlag, an open-source M&A cybersecurity due-diligence tool, the formula combines four weighted factors:

score = (cvss_norm × 0.35)        ← how severe are the CVEs?
      + (exposure  × 0.25)        ← is this internet-facing?
      + (sensitivity × 0.25)      ← data classification (always UNKNOWN — no asset inventory)
      + (exploit   × 0.15)        ← are CVEs weaponised?
      × evidence_multiplier        ← how confident is the data?

Factor	Value	Score
Exposure	Internet-facing (HTTP/SSH/RDP/DB ports)	100
Exposure	Unknown	50
Exploit status	Public CVE linked by Shodan	65
Exploit status	No CVE data	30
Evidence	CORRELATED — CVEs + port confirmed	×0.95
Evidence	INFERRED — host found, no CVEs	×0.85

Risk level bands: critical ≥ 75 · high ≥ 50 · medium ≥ 25 · low < 25

Graph output

(Ip) -[HAS_RISK_PROFILE]-> (RiskProfile)
(Ip) -[HAS_PORT]->         (Port)          ← one per open Shodan port

The RiskProfile node carries:

• overall_risk_score (0–100), risk_level, assessment_date
• vulnerabilities (CVE IDs), risk_factors, attack_vectors
• exposure_surface (org, ASN, hostnames, open ports)
• compliance_risks (PCI-DSS / GDPR / ISO 27001 flags)
• mitigation_strategies, confidence, source = "Shodan"

Required vault secret

Key	Where to get it
SHODAN_API_KEY	https://account.shodan.io — 1 credit per api.host() call

Test plan

• Add SHODAN_API_KEY to Flowsint vault
• Open any Ip node in the investigation graph
• Run enricher ip_to_security_risk on it
• Verify RiskProfile node appears linked via HAS_RISK_PROFILE
• Verify Port nodes appear linked via HAS_PORT
• Confirm score and risk level are plausible for the IP under test
• Confirm a Shodan-rate-limited or invalid key returns a graceful log warning, not a crash

Files changed

File	Change
flowsint-enrichers/src/flowsint_enrichers/ip/to_security_risk.py	New — full enricher implementation
flowsint-enrichers/pyproject.toml	Added shodan>=1.31,<2.0 dependency

[adityaa206]

I am making another project kind of related to this so was interested in yours too but yea look into it if it works

[dextmorgn]

Great addition ! Have you tested it ?

[adityaa206]

yes I did, I also made some edits after reviewing the code again and checked for default values which I was using to test out stuff and edited it and now its fixed and yea. Please test it out yourself if you have time. Thank youuu. Let me know if anythng wrong and needs to be fixed

[adityaa206]

About the API btw, its free and it doesnt use the credits for the scans so yea its free