CognitiveVault

CognitiveVault is a local-only research prototype for a cognitive cyber defense password manager. It keeps a small encrypted password vault on the user's machine, scores website risk before autofill, estimates the user's current cognitive state from aggregate behavior signals, and applies a decision matrix that can allow, delay, confirm, or block autofill.

This is a course project prototype, not production password-manager software. Use only demo credentials.

What Is Implemented

• Encrypted local vault using Argon2id key derivation and AES-256-GCM authenticated encryption.
• Transparent local site-risk classifier with explainable per-feature contributions.
• Aggregate cognitive-load estimator using typing speed, correction rate, typo rate, reaction latency, and mouse jitter.
• Decision matrix that combines site risk, cognitive state, and credential matching.
• Browser dashboard at http://127.0.0.1:8765/.
• Manifest V3 browser extension prototype that asks the local API before autofill.
• Tests for crypto, vault persistence, risk scoring, fatigue estimation, decision behavior, and API flow.
• LaTeX report source, defense briefing, and demo script.

Architecture

flowchart LR
    UI["Dashboard UI"] --> API["Local API on 127.0.0.1"]
    EXT["Browser Extension"] --> API
    API --> VAULT["Encrypted Vault"]
    API --> RISK["Site Risk Model"]
    API --> FATIGUE["Cognitive State Estimator"]
    RISK --> MATRIX["Decision Matrix"]
    FATIGUE --> MATRIX
    VAULT --> MATRIX
    MATRIX --> EXT

Loading

The design is intentionally local. The vault file and fatigue baseline are written under data/, which is ignored by Git. No telemetry or behavioral samples are sent to a remote server.

Quick Start

Use Python 3.11 or newer.

python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -e .[dev]
python -m cognitive_vault.cli serve --port 8765

If you are using the bundled runtime inside Codex:

& 'C:\Users\osid-\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe' -m pip install -e .[dev]
& 'C:\Users\osid-\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe' -m cognitive_vault.cli serve --port 8765

Then open:

http://127.0.0.1:8765/

Demo Flow

1. Create a vault with a demo master password.
2. Add the default demo credential for http://127.0.0.1:8765/demo/login.
3. Analyze https://github.com/login and then https://githab.com/login.
4. Type in the cognitive probe, run the reaction test, and assess the state.
5. Evaluate the decision matrix for the demo login and a suspicious URL.
6. Load the extension/ folder as an unpacked browser extension.
7. Open http://127.0.0.1:8765/demo/login and request autofill from the extension popup.

Browser Extension

The extension is a prototype in extension/.

• popup.js calls /api/extension/decision and /api/extension/autofill.
• content.js detects username/password fields and fills them only after local approval.
• Confirm-level decisions require the user to click the extension's explicit confirmation button before credentials are released.
• manifest.json uses broad match permissions for demonstration. This is listed as a limitation, not a production recommendation.

Development Commands

Run tests:

python -m pytest -q

Analyze one URL from the CLI:

python -m cognitive_vault.cli risk https://githab.com/login --protected-domain github.com

Classify one cognitive sample:

python -m cognitive_vault.cli fatigue --typing-cps 1.2 --typo-rate 0.2 --correction-rate 0.25 --reaction-ms 1200 --mouse-jitter 24

Folder Structure

src/cognitive_vault/
  crypto.py        Argon2id and AES-GCM helpers
  vault.py         encrypted vault model
  risk.py          transparent local URL risk model
  fatigue.py       aggregate cognitive-state estimator
  decision.py      autofill decision matrix
  server.py        local HTTP API and dashboard server
  web_assets/      dashboard HTML/CSS/JS
extension/         Manifest V3 extension prototype
tests/             automated tests
docs/              project, demo, and defense documentation
report/            LaTeX report source
tools/             artifact-generation scripts

Limitations

• The site-risk model is a transparent calibrated prototype, not a validated phishing-detection model.
• The cognitive estimator is rule-based and uses aggregate local metrics; it has not been validated with human-subject data.
• The extension is suitable for demonstration only and should not be used with real accounts.
• The local API has no user authentication because it is scoped to a single-user localhost demo.
• The vault does not implement synchronization, secure memory wiping, hardware-backed keys, or recovery.
• SHAP is not implemented. Instead, the project uses exact feature contributions from a transparent linear model.

Academic References Used In The Report

• RFC 9106: Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications.
• NIST SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode.
• NIST SP 800-63B-4: Digital Identity Guidelines: Authentication and Authenticator Management.
• Silver, Jana, Boneh, Chen, and Jackson, "Password Managers: Attacks and Defenses," USENIX Security 2014.
• Dhamija, Tygar, and Hearst, "Why Phishing Works," CHI 2006.
• Akhawe and Felt, "Alice in Warningland," USENIX Security 2013.
• Zhuo et al., "The Impact of Workload on Phishing Susceptibility," USEC 2024.

GitHub Metadata

Suggested repository description:

Local cognitive cyber defense password manager prototype with encrypted vault, explainable site-risk scoring, fatigue estimation, and adaptive autofill.

Suggested topics:

password-manager cybersecurity argon2id aes-gcm phishing-detection usable-security explainable-ai browser-extension local-first security-research