PentexOne: Building An On-Premises AI-Powered IoT Security Scanner On Raspberry Pi + Video

Introduction:

The proliferation of Internet of Things (IoT) devices across enterprise and residential networks has dramatically expanded the attack surface, introducing vulnerabilities that traditional security tools often overlook. PentexOne, an on-premises IoT security scanner developed as a graduation project at Misr International Technology University, addresses this gap by combining automated device discovery, CVE matching, and AI-driven risk scoring into a portable solution running on a Raspberry Pi. This article explores the technical architecture, implementation methodologies, and practical deployment strategies for building a similar IoT security assessment platform.

Learning Objectives:

Understand the core components of an IoT security scanner, including network discovery, vulnerability identification, and risk prioritization.
Learn how to implement CVE matching using the National Vulnerability Database (NVD) API and CVSS-based scoring.
Deploy an AI-powered risk scoring engine to contextualize and prioritize vulnerabilities in IoT environments.
Gain hands-on experience with Linux-based security tools, Python scripting, and Raspberry Pi optimization for security scanning.

1. Network Discovery and Device Fingerprinting

The foundation of any IoT security scanner is the ability to discover and identify devices on the network. PentexOne leverages tools like Nmap to detect active hosts, open ports, and running services across multiple IoT protocols including MQTT, CoAP, and Zigbee.

Step-by-Step Guide:

1. Install Nmap on Raspberry Pi:

sudo apt update && sudo apt install nmap -y

Perform a basic network scan to discover live hosts:
```
sudo nmap -sn 192.168.1.0/24
```
This ping sweep identifies all active devices on the local subnet.
Conduct a comprehensive service and OS fingerprinting scan:
```
sudo nmap -sS -sV -O -p- 192.168.1.100
```
The `-sS` flag performs a stealth SYN scan, `-sV` detects service versions, `-O` attempts OS detection, and `-p-` scans all 65,535 ports.
Use Nmap Scripting Engine (NSE) for IoT-specific vulnerability probes:
```
sudo nmap --script=iot 192.168.1.100
```
This runs scripts targeting known IoT vulnerabilities and misconfigurations.
Parse Nmap output for integration with vulnerability databases:
```
nmap -oX scan_output.xml 192.168.1.0/24
```

XML output facilitates automated parsing and CVE correlation.

2. CVE Matching and Vulnerability Correlation

Once devices and services are identified, the next critical step is matching discovered service banners and firmware versions against known vulnerabilities. PentexOne implements a fuzzy CVE matching algorithm that queries the NIST National Vulnerability Database (NVD) API.

Step-by-Step Guide:

Obtain an NVD API key from NIST (free registration required).

2. Install Python dependencies:

pip install requests pandas python-1vd3

Python script for CVE lookup based on service banners:
```
import requests
import json</li>
</ol>

def query_nvd(service, version):
url = f"https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch={service}%20{version}"
response = requests.get(url)
if response.status_code == 200:
data = response.json()
for vuln in data.get('vulnerabilities', []):
cve_id = vuln['cve']['id']
cvss_score = vuln['cve']['metrics'].get('cvssMetricV31', [{}])[bash].get('cvssData', {}).get('baseScore', 'N/A')
print(f"CVE: {cve_id} | CVSS: {cvss_score}")
```
1. Implement rate limiting and caching to avoid NVD API throttling:
```
import time
from functools import lru_cache</li>
</ol>

@lru_cache(maxsize=1000)
def cached_cve_lookup(service, version):
time.sleep(0.6)  Respect NVD rate limits
return query_nvd(service, version)
```
  1. Map detected services to CVEs and generate a vulnerability report.
  3. AI-Powered Risk Scoring Engine
  
  Traditional CVSS scores provide a severity baseline but lack contextual awareness of the specific deployment environment. PentexOne incorporates an AI-powered risk scoring engine that factors in device criticality, network exposure, and exploitability to produce a prioritized risk score.
  
  Step-by-Step Guide:
  
  1. Define risk scoring factors:
  - CVSS Base Score: Technical severity (0–10)
  - Device Criticality: Business impact (1–5)
  - Network Exposure: Internal vs. external facing (1–3)
  - Exploit Availability: Public exploit existence (1–3)
  - Asset Value: Sensitivity of data handled (1–5)
  2. Implement a weighted scoring model in Python:
```
def calculate_risk_score(cvss, criticality, exposure, exploit, asset_value):
weights = {'cvss': 0.35, 'criticality': 0.25, 'exposure': 0.15, 'exploit': 0.15, 'asset': 0.10}
normalized_cvss = cvss / 10
score = (normalized_cvss  weights['cvss'] +
(criticality/5)  weights['criticality'] +
(exposure/3)  weights['exposure'] +
(exploit/3)  weights['exploit'] +
(asset_value/5)  weights['asset'])
return round(score  10, 1)  Scale to 0-10
```
  1. Train a machine learning model for adaptive scoring using historical vulnerability data and remediation outcomes:
```
from sklearn.ensemble import RandomForestRegressor
Features: CVSS, device_type, protocol, age, patch_status
Target: observed_impact_score
model = RandomForestRegressor(n_estimators=100)
model.fit(X_train, y_train)
```
  2. Deploy the scoring engine as a Flask API service for integration with the scanner.
  3. Generate prioritized remediation lists sorted by the AI-calculated risk score.
  4. Deployment on Raspberry Pi
  
  PentexOne is designed to run on resource-constrained hardware, making it suitable for edge deployment in IoT environments.
  
  Step-by-Step Guide:
  1. Set up Raspberry Pi with Raspberry Pi OS (64-bit) and enable SSH for headless operation.
  2. Install required security tools:
```
sudo apt install -y nmap wireshark tcpdump python3-pip git
```
  3. Clone and configure the PentexOne scanner:
```
git clone https://github.com/your-repo/pentexone.git
cd pentexone
pip install -r requirements.txt
```
  4. Configure network interfaces for monitoring:
```
sudo ip link set wlan0 promisc on
```
  5. Schedule automated scans using cron:
```
crontab -e
 Run daily at 2 AM
0 2    /usr/bin/python3 /home/pi/pentexone/scanner.py --output /var/log/pentexone/
```
  1. Optimize performance by disabling unnecessary services and using lightweight tools like `masscan` for large networks.
  5. Multi-Protocol IoT Security Testing
  
  IoT ecosystems rely on diverse communication protocols, each with unique security considerations. PentexOne supports testing across MQTT, CoAP, Zigbee, and Bluetooth Low Energy (BLE).
  
  Step-by-Step Guide:
  
  1. MQTT Security Testing:
```
 Test for anonymous access
mosquitto_sub -h 192.168.1.100 -t "" -v
 Brute-force credentials
hydra -l admin -P passwords.txt mqtt://192.168.1.100
```
  2. CoAP Protocol Analysis:
```
 Discover CoAP endpoints
coap-client -m get coap://192.168.1.100/.well-known/core
```
  3. BLE Device Scanning:
```
sudo hcitool scan
sudo gatttool -b XX:XX:XX:XX:XX:XX --characteristics
```
  1. Zigbee Network Analysis using specialized tools like killerbee.
  5. Consolidate findings into a unified vulnerability report.
  
  6. Report Generation and Visualization
  
  PentexOne generates comprehensive security reports with visualizations for stakeholders.
  
  Step-by-Step Guide:
  
  1. Install reporting dependencies:
```
pip install matplotlib jinja2 weasyprint
```
  1. Generate HTML and PDF reports with vulnerability summaries, risk scores, and remediation recommendations.
  3. Create network topology visualizations using `graphviz`:
```
sudo apt install graphviz
python3 -c "import pygraphviz; print('OK')"
```
  1. Export reports in multiple formats (JSON, PDF, HTML) for integration with SIEM platforms.
  What Undercode Say:
  - IoT Security is an Ecosystem Challenge: PentexOne demonstrates that effective IoT security requires more than just vulnerability scanning—it demands contextual risk assessment that accounts for device criticality and network exposure. The AI-powered risk scoring engine transforms raw CVE data into actionable intelligence.
  - Edge Deployment is the Future: Running security scanners on Raspberry Pi-class hardware proves that comprehensive security assessment can be achieved without expensive enterprise appliances. This democratization of security tools enables organizations of all sizes to protect their IoT deployments.
  The project highlights a critical gap in the current security landscape: most organizations lack visibility into their IoT devices and the vulnerabilities they introduce. PentexOne addresses this by providing an accessible, on-premises solution that combines proven open-source tools with intelligent risk prioritization. The integration of AI for contextual scoring represents a significant advancement over traditional CVSS-only approaches, enabling security teams to focus remediation efforts on the vulnerabilities that pose the greatest actual risk to their environment.
  
  Prediction:
  - +1 The adoption of AI-powered risk scoring in IoT security will become standard practice within 3–5 years, moving beyond academic projects to enterprise-grade solutions as organizations recognize the limitations of static CVSS scores.
  - +1 Raspberry Pi-based security appliances will gain mainstream acceptance for edge deployments, driven by their low cost, flexibility, and the growing availability of optimized security distributions.
  - -1 The rapid proliferation of IoT devices will continue to outpace security measures, with attackers increasingly targeting IoT as an entry point for lateral movement within enterprise networks—highlighting the critical need for tools like PentexOne.
  - +1 Open-source IoT security frameworks will converge around standardized APIs for CVE correlation and risk scoring, enabling interoperability across different scanner implementations.
  - -1 Without widespread adoption of automated vulnerability assessment for IoT, we can expect a significant increase in IoT-related data breaches and ransomware incidents targeting connected devices over the next 24 months.
  ▶️ Related Video (86% Match):
  
  https://www.youtube.com/watch?v=1tnXyw5HjuU
  
  🎯Let’s Practice For Free:
  
  🎓 Live Courses & Certifications:
  
  Join Undercode Academy for Verified Certifications
  
  🚀 Request a Custom Project:
  
  Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
  [email protected]
  💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
  
  IT/Security Reporter URL:
  
  Reported By: Mohamed Hamdy – Hackers Feeds
  Extra Hub: Undercode MoN
  Basic Verification: Pass ✅
  
  🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
  
  💬 Whatsapp | 💬 Telegram
  
  📢 Follow UndercodeTesting & Stay Tuned:
  
  𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky
  Share this:
  Reddit
  LinkedIn
  Threads
  Pinterest
  Bluesky
  WhatsApp
  X
  Telegram
  Facebook
  Email
  Tumblr
  Mastodon
  Print

Listen to this Post

Introduction:

Learning Objectives:

1. Network Discovery and Device Fingerprinting

Step-by-Step Guide:

1. Install Nmap on Raspberry Pi:

XML output facilitates automated parsing and CVE correlation.

2. CVE Matching and Vulnerability Correlation

Step-by-Step Guide:

2. Install Python dependencies:

3. AI-Powered Risk Scoring Engine

Step-by-Step Guide:

1. Define risk scoring factors:

2. Implement a weighted scoring model in Python:

4. Deployment on Raspberry Pi

Step-by-Step Guide:

2. Install required security tools:

3. Clone and configure the PentexOne scanner:

4. Configure network interfaces for monitoring:

5. Schedule automated scans using cron:

5. Multi-Protocol IoT Security Testing

Step-by-Step Guide:

1. MQTT Security Testing:

2. CoAP Protocol Analysis:

3. BLE Device Scanning:

5. Consolidate findings into a unified vulnerability report.

6. Report Generation and Visualization

Step-by-Step Guide:

1. Install reporting dependencies:

3. Create network topology visualizations using `graphviz`:

What Undercode Say:

Prediction:

▶️ Related Video (86% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

🚀 Request a Custom Project:

IT/Security Reporter URL:

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

📢 Follow UndercodeTesting & Stay Tuned:

Share this:

Related Posts: