# 🤖 How I Integrated Kali Linux and DeepSeek (Local AI) to Build a Self-Defending Security Bot for MyZubster

> Source: <https://dev.to/danielioni/how-i-integrated-kali-linux-and-deepseek-local-ai-to-build-a-self-defending-security-bot-for-47lk>
> Published: 2026-07-22 11:20:56+00:00

🤖 How I Integrated Kali Linux and DeepSeek (Local AI) to Build a Self-Defending Security Bot for MyZubster

A step-by-step guide on why and how I combined penetration testing tools with local AI to protect a decentralized marketplace.

🧠 Introduction

MyZubster is a decentralized marketplace where users tokenize real‑world assets and trade them using Monero (XMR) payments. But any platform handling tokens, transactions, and sensitive user data must be secure.

Instead of relying on passive security measures or expensive third‑party APIs, I decided to build an autonomous security bot that:

```
Scans the gateway every hour using Kali Linux tools (nmap, nikto, sqlmap).

Analyzes the results with a local AI model (DeepSeek R1:1.5B running on Ollama).

Acts automatically: blocks suspicious IPs, suspends users, cancels open orders.
```

Everything runs locally – zero data shared with third parties, zero ongoing costs.

🔍 Why Kali Linux?

Kali Linux is the de‑facto standard for security auditing and penetration testing. It bundles over 600 pre‑installed tools for network scanning, web application testing, and forensics.

In MyZubster, I use:

```
nmap – to scan open ports on the gateway.

nikto – to check for common web vulnerabilities.

sqlmap – to detect SQL injection risks.
```

All tools are integrated into a single Python script that runs automatically.

Benefits of Kali Linux in MyZubster

```
✅ Reliable – battle‑tested tools trusted by security professionals.

✅ Up‑to‑date – actively maintained by the Kali community.

✅ Modular – I can easily add or remove tools.

✅ Containerizable – I run Kali inside a Docker container, isolated from the main system.
```

🧠 Why DeepSeek (Local)?

For log analysis, I didn't want to use external APIs (e.g., OpenAI) for two main reasons:

```
Privacy – logs may contain sensitive information about users and transactions.

Cost – continuous analysis would incur significant recurring fees.
```

I chose DeepSeek R1:1.5B running locally via Ollama:

```
✅ Zero cost – no API keys, no credit usage.

✅ Total privacy – data never leaves the server.

✅ Fast response – the model is lightweight and CPU‑optimised.

✅ Customisable – I can tailor prompts to produce structured reports.
```

🏗️ System Architecture

text

┌─────────────────────────────────────────────────────────────────┐

│ MyZubster Server │

├─────────────────────────────────────────────────────────────────┤

│ │

│ ┌──────────────────────────────────────────────────────────┐ │

│ │ Gateway (Node.js + Express) │ │

│ │ - REST API │ │

│ │ - JWT Authentication │ │

│ │ - MongoDB models │ │

│ │ - PaymentMonitor (Monero) │ │

│ └──────────────────────────────────────────────────────────┘ │

│ ▲ │

│ │ │

│ ┌──────────────────────────────────────────────────────────┐ │

│ │ Security Bot (Python) │ │

│ │ - Runs nmap / nikto / sqlmap │ │

│ │ - Calls DeepSeek via internal API │ │

│ │ - Executes actions: block IP, suspend user, cancel order│ │

│ │ - Logs everything to /var/log/security_bot.log │ │

│ └──────────────────────────────────────────────────────────┘ │

│ ▲ │

│ │ │

│ ┌──────────────────────────────────────────────────────────┐ │

│ │ DeepSeek (Ollama) │ │

│ │ - Model: deepseek-r1:1.5b │ │

│ │ - Local API on [http://localhost:11434](http://localhost:11434) │ │

│ │ - Analyses logs and returns structured reports │ │

│ └──────────────────────────────────────────────────────────┘ │

└─────────────────────────────────────────────────────────────────┘

🛠️ Implementation Steps

1️⃣ Install Kali Tools

bash

apt update

apt install nmap nikto sqlmap -y

2️⃣ Install Ollama and Pull DeepSeek

bash

curl -fsSL [https://ollama.com/install.sh](https://ollama.com/install.sh) | sh

ollama pull deepseek-r1:1.5b

3️⃣ Python Security Bot (security_bot.py)

The bot logs into MyZubster, runs nmap, sends the output to DeepSeek, and takes action.

python

import subprocess

import requests

import json

MYZUBSTER_API = "[http://localhost:3000/api](http://localhost:3000/api)"

def login():

resp = requests.post(f"{MYZUBSTER_API}/auth/login",

json={"email":"[test@example.com](mailto:test@example.com)","password":"Test123!"})

return resp.json().get('token')

def ask_deepseek(prompt):

resp = requests.post(

f"{MYZUBSTER_API}/ai/ask",

json={"prompt": prompt},

headers={'Authorization': f'Bearer {TOKEN}'}

)

return resp.json().get('response')

def scan_gateway():

result = subprocess.run(['nmap', '-p', '3000,80,443', 'localhost'], capture_output=True, text=True)

return result.stdout

def block_ip(ip):

subprocess.run(['ufw', 'deny', 'from', ip], check=False)

4️⃣ Node.js Service for DeepSeek Integration (deepseekService.js)

javascript

const axios = require('axios');

const OLLAMA_URL = '[http://localhost:11434/api/chat](http://localhost:11434/api/chat)';

const MODEL_NAME = 'deepseek-r1:1.5b';

async function askDeepSeek(prompt) {

const response = await axios.post(OLLAMA_URL, {

model: MODEL_NAME,

messages: [{ role: 'user', content: prompt }],

stream: false

});

return response.data.message.content;

}

5️⃣ Automate with Cron (Every Hour)

bash

crontab -e

0 * * * * /usr/bin/python3 /root/security_bot.py >> /var/log/security_bot.log 2>&1

🧪 Example Output

text

🔐 Login to MyZubster...

🔍 Starting security scan...

📊 Scan completed. Sending to DeepSeek for analysis...

**MyZubster Security Report**

Open ports detected:

Potential vulnerabilities:

Recommendations:

✅ Benefits of This Integration

Feature Advantage

Automation Scans and analysis run without manual intervention

Privacy Data never leaves the server

Cost Zero API costs (DeepSeek is local)

Reactivity Immediate actions when a threat is detected

Customisability I can extend tools and AI prompts as needed

🚀 Next Steps

```
Add more Kali tools – nikto, sqlmap, gobuster.

Telegram/Email webhooks – get notified when the bot detects a threat.

Security dashboard – visualise reports in real time.

Predictive analysis – use DeepSeek to forecast potential attacks.
```

📌 Conclusion

Kali Linux and DeepSeek are not competing tools – they complement each other perfectly:

```
Kali provides the means to detect threats.

DeepSeek provides the intelligence to interpret data and decide on actions.
```

Together, they turn MyZubster into a self‑defending platform that proactively protects itself and its users.

🔗 Resources

```
GitHub: DanielIoni-creator/MyZubsterGateway

Live Demo: https://myzubster.com

Ollama: https://ollama.com

Kali Linux: https://www.kali.org
```

Built with ❤️ by the MyZubster team.

🏷️ Tags