GeoWatch Tower is a cryptographic geolocation verification and behavioral anomaly detection framework. It generates tamper-proof GeoProofs from device data, validates identity authenticity through per-user DNA Honeypots, and records verified proofs on a public Witness Ledger using Zero-Knowledge Proofs and Merkle hashing.

GeoWatch Tower™ operates at the intersection of:

1. User & Entity Behavior Analytics (UEBA)
2. Zero Trust Identity
3. Cryptographic Verifiability
4. Open Threat Intelligence

creating a new category: Verifiable Digital Presence (VDP).

git clone https://github.com/SakaethRam/GeoWatchTower.git
cd GeoWatch-Tower

pip install -r requirements.txt

Or install manually:

pip install neo4j geopy requests scikit-learn pandas networkx cryptography ipfshttpclient py-ed25519 pyzeroknp

jupyter notebook "GeoWatch Tower (v1.0).ipynb"

FROM python:3.10-slim

WORKDIR /app

COPY . /app

RUN pip install --no-cache-dir \
    neo4j geopy requests scikit-learn pandas networkx cryptography ipfshttpclient py-ed25519 pyzeroknp

CMD ["jupyter", "notebook", "--ip=0.0.0.0", "--allow-root", "--NotebookApp.token=''", "--NotebookApp.password=''"]

docker build -t geowatch-tower .

docker run -p 8888:8888 geowatch-tower

GeoWatch-Tower/
│
├── GeoWatch Tower (v1.0).ipynb     # Main executable notebook
├── requirements.txt                 # Dependencies list
├── Dockerfile                       # Container setup
│
├── core/
│   ├── geoproof.py                  # Cryptographic GeoProof engine (Ed25519)
│   ├── honeypot.py                  # DNA Honeypot logic
│   ├── anomaly_detector.py          # ML model for travel anomaly detection
│   └── ledger.py                    # Merkle + ZKP ledger integration
│
└── utils/
    ├── geo_utils.py                 # GeoIP & distance utilities
    └── visualization.py             # NetworkX-based cluster visualization

Architecture Overview

 ┌────────────────────────┐
 │   User Device / Node   │
 └──────────┬─────────────┘
            │
        (GeoProof)
            │
 ┌──────────▼─────────────┐
 │  GeoWatch Engine (ML)  │
 └──────────┬─────────────┘
            │
       (Merkle + ZKP)
            │
 ┌──────────▼─────────────┐
 │  Public Witness Ledger │
 └────────────────────────┘

Scenario: An enterprise platform wants to prevent account takeovers by verifying that login requests originate from legitimate, geographically consistent devices. GeoWatch Tower ensures each access event carries a signed GeoProof bound to the device, preventing impersonation, spoofing, and synthetic identity attacks.

1. Proof Generation The device captures GPS/IP data and generates a signed proof using Ed25519.
2. DNA Honeypot Injection Per-user honeypots are deployed to detect automation and mimicry attacks.
3. Anomaly Detection Travel and access events are analyzed using ML and graph models to detect impossible travel or correlated fraud.
4. Ledger Validation Valid proofs are recorded to a public Witness Ledger using Merkle Trees and ZK Proofs.
5. Audit & Visualization Administrators can query the Neo4j/Graph DB to visualize behavioral clusters and anomaly risk.

Contributions are welcome. Please fork the repository, make your changes, and submit a pull request. Ensure that all code is properly documented and tested.

To contribute:

• Fork the repository.
• Create a feature branch.
• Implement your changes.
• Submit a pull request with a clear description of modifications.

© 2025 GeoWatch Tower | Secure ARKIN X Standard v1.0