scan_diff.py

import json
from datetime import datetime
from collections import defaultdict

def load_scan_data(filepath):
    """Load scan results from a JSON file."""
    with open(filepath, 'r', encoding='utf-8') as f:
        return json.load(f)

def find_port_changes(current_file="results.json", history_file="scan_history.json"):
    """Compare current scan against historical scans and report delta."""
    print(f"[*] Loading current scan from {current_file}...")
    current = load_scan_data(current_file)
    
    if not current:
        print("[!] Current scan is empty. No comparison possible.")
        return
    
    # Load history file (always exists — we append every scan)
    try:
        with open(history_file, 'r', encoding='utf-8') as f:
            history = json.load(f)
        
        if not history:
            print("[!] Scan history is empty. Saving first record.")
            history.append({"timestamp": datetime.now().isoformat(), "devices": current})
            save_history(history, history_file)
            return
        
        previous = history[-1]["devices"]  # Most recent scan
        timestamp = history[-1]["timestamp"]
        
    except FileNotFoundError:
        print("[!] No scan history found. Saving first record.")
        history.append({"timestamp": datetime.now().isoformat(), "devices": current})
        save_history(history, history_file)
        return
    
    # Build lookup maps by IP
    current_map = {d['ip']: d for d in current}
    previous_map = {d['ip']: d for d in previous}
    
    current_ips = set(current_map.keys())
    previous_ips = set(previous_map.keys())
    
    new_devices = current_ips - previous_ips
    removed_devices = previous_ips - current_ips
    common_ips = current_ips & previous_ips
    
    # Track port changes within common devices
    new_ports_by_ip = defaultdict(list)   # Port appeared since last scan
    closed_ports_by_ip = defaultdict(list)  # Port disappeared since last scan
    risk_changes = {}  # IP -> old_risk -> new_risk
    
    for ip in common_ips:
        curr_device = current_map[ip]
        prev_device = previous_map[ip]
        
        curr_ports = {(p['port'], p['service']) for p in curr_device.get('open_ports', [])}
        prev_ports = {(p['port'], p['service']) for p in prev_device.get('open_ports', [])}
        
        if curr_ports != prev_ports:
            new = curr_ports - prev_ports
            closed = prev_ports - curr_ports
            
            if new:
                for port, service in new:
                    new_ports_by_ip[ip].append({"port": port, "service": service})
            
            if closed:
                for port, service in closed:
                    closed_ports_by_ip[ip].append({"port": port, "service": service})
        
        # Track risk level changes
        prev_risk = max((p.get('risk_level', 'safe') for p in prev_device.get('open_ports', [])), default='safe')
        curr_risk = max((p.get('risk_level', 'safe') for p in curr_device.get('open_ports', [])), default='safe')
        if prev_risk != curr_risk:
            risk_changes[ip] = {"from": prev_risk, "to": curr_risk}
    
    # Build change summary
    changes = []
    severity_count = {"critical": 0, "warning": 0, "info": 0}
    
    for ip in new_devices:
        dev = current_map[ip]
        ports_str = ", ".join(f"{p['port']}/{p['service']}" for p in dev.get('open_ports', []))
        changes.append({"type": "new_device", "ip": ip, "hostname": dev.get('hostname', 'Unknown'), "ports": ports_str})
    
    for ip in removed_devices:
        changes.append({"type": "device_removed", "ip": ip, "hostname": previous_map[ip].get('hostname', 'Unknown')})
    
    for ip, port_list in new_ports_by_ip.items():
        ports_str = ", ".join(f"{p['port']}/{p['service']}" for p in port_list)
        risk = "critical" if any(p['port'] in {21, 23, 445, 3389, 1433, 3306} for p in port_list) else "warning"
        changes.append({"type": "new_ports", "ip": ip, "ports": ports_str, "severity": risk})
    
    for ip, port_list in closed_ports_by_ip.items():
        ports_str = ", ".join(f"{p['port']}/{p['service']}" for p in port_list)
        changes.append({"type": "closed_ports", "ip": ip, "ports": ports_str, "severity": "info"})
    
    for ip, risk_map in risk_changes.items():
        changes.append({"type": "risk_change", "ip": ip, "from": risk_map['from'], "to": risk_map['to']})
        severity_count["warning"] += 1 if risk_map['to'] == 'critical' else 1
    
    # Determine overall severity
    has_critical = any(
        c.get('severity') in ('critical', 'warning') or 
        c.get('type') in ('new_device', 'risk_change')
        for c in changes
    )
    
    # Print results
    print("\n" + "=" * 60)
    print("  SCAN CHANGE REPORT")
    print("=" * 60)
    print(f"\nLast scan: {timestamp}")
    print(f"Current devices: {len(current)} | Previous: {len(previous)}")
    print(f"New devices: {len(new_devices)} | Removed: {len(removed_devices)}")
    
    if changes:
        # Sort: new devices first, then new ports, then risk changes, then removed
        type_order = {"new_device": 0, "new_ports": 1, "risk_change": 2, "closed_ports": 3, "device_removed": 4}
        changes.sort(key=lambda c: type_order.get(c['type'], 5))
        
        print(f"\n[!] {len(changes)} change(s) detected:\n")
        for i, change in enumerate(changes, 1):
            change_type = change['type'].replace('_', ' ').title()
            
            if change['type'] == 'new_device':
                print(f"  {i}. [NEW DEVICE] {change['ip']} ({change.get('hostname', 'Unknown')})")
                if change.get('ports'):
                    print(f"     Open ports: {change['ports']}")
            
            elif change['type'] == 'new_ports':
                sev = change.get('severity', '?').upper()
                print(f"  {i}. [NEW PORTS] {change['ip']} ({sev})")
                print(f"     {change['ports']}")
            
            elif change['type'] == 'risk_change':
                print(f"  {i}. [RISK CHANGE] {change['ip']}: {change['from'].upper()} -> {change['to'].upper()}")
            
            elif change['type'] == 'closed_ports':
                print(f"  {i}. [CLOSED PORTS] {change['ip']}")
                print(f"     {change['ports']}")
            
            elif change['type'] == 'device_removed':
                print(f"  {i}. [DEVICE REMOVED] {change['ip']} ({change.get('hostname', 'Unknown')})")
    else:
        print("\n[+] No changes detected. Network unchanged since last scan.")
    
    # Save current scan to history
    history.append({"timestamp": datetime.now().isoformat(), "devices": current})
    save_history(history, history_file)
    print(f"\n[*] Current scan saved to {history_file}")
    return changes

def save_history(history, filepath="scan_history.json"):
    with open(filepath, 'w', encoding='utf-8') as f:
        json.dump(history, f, indent=4)

if __name__ == "__main__":
    find_port_changes()