Home
A GSOC-level, production-ready AI security platform that ingests real-time network logs, detects anomalies using Isolation Forest ML, and visualizes threats on an interactive Next.js dashboard with immersive 3D visualizations.
| Page | Description |
|---|---|
| Home | Project overview, goals, and wiki index |
| Architecture | System design, data flow, and component breakdown |
| Setup-Guide | Local development setup and deployment |
| API-Reference | Full REST API documentation with examples |
| Contributing | How to contribute — code, docs, or testing |
| GSoC-Project-Ideas | Open GSoC ideas, mentorship info, and how to apply |
This platform bridges the gap between traditional log monitoring and modern AI-driven threat intelligence. It ingests system and network logs in real-time, scores them with a trained Isolation Forest machine learning model, and presents actionable insights on a dynamic dashboard — empowering security teams to detect zero-day attacks and subtle behavioral anomalies that rule-based systems miss.
| Feature | Description |
|---|---|
| 🕵️ Real-time Anomaly Detection | Unsupervised Isolation Forest ML detects outliers in network traffic |
| 📊 Interactive Dashboard | Next.js + Recharts for live traffic, threats, and log visualization |
| 🌐 3D Threat Globe | React Three Fiber globe showing global threat distribution |
| 🔗 3D Network Topology | Real-time 3D node graph of server/client/threat relationships |
| ⚡ High-Performance API | FastAPI with millisecond-latency log ingestion and inference |
| 📥 Universal Log Ingestion | Parses standardized system logs and network traffic data |
| 🚨 Threat Classification | Auto-classifies events as Normal, Suspicious, or Critical |
| 🧪 Tested Backend | Full pytest suite covering success, error, and pagination cases |
- Python 3.10+ — Core logic
- FastAPI — High-performance async REST API
- Scikit-learn — Isolation Forest ML model
- Pandas & NumPy — Feature engineering and data manipulation
- SQLAlchemy + SQLite — ORM and relational storage (PostgreSQL-ready)
- Pytest + HTTPX — Unit and integration testing
- Next.js 14 — React production framework
- TailwindCSS — Utility-first styling
- Recharts — Composable charting
- Three.js + React Three Fiber — WebGL 3D visualizations
- @react-three/drei — Three.js helpers and abstractions
- Lucide React — Icon library
-
GitHub Actions — Automated CI pipeline (
ci.yml) - Docker — Containerized deployment (roadmap)
- PYTHONPATH — Configured for seamless backend module imports in CI
ai-security-platform/
├── .github/
│ └── workflows/
│ └── ci.yml # GitHub Actions CI pipeline
├── ai-model/
│ ├── train_model.py # Isolation Forest training script
│ └── isolation_forest_model.pkl
├── backend/
│ ├── main.py # FastAPI application entry point
│ ├── models.py # SQLAlchemy database models
│ ├── schemas.py # Pydantic request/response schemas
│ ├── routes/ # API route handlers
│ ├── requirements.txt
│ └── tests/
│ ├── test_health.py # Health check endpoint tests
│ ├── test_logs.py # /logs/ endpoint unit tests
│ └── test_predict.py # /predict/ endpoint tests
├── data/
│ └── generated_logs.csv # Simulated training dataset
├── docs/
│ └── advanced_features.md # Advanced implementation guide
├── frontend/
│ ├── pages/ # Next.js pages
│ ├── components/ # React components (charts, 3D globe, etc.)
│ └── package.json
├── CONTRIBUTING.md
├── SECURITY.md
├── SETUP_GUIDE.md
└── README.md
- Core Log Ingestion & Database (SQLite + SQLAlchemy)
- Isolation Forest Anomaly Detection Model
- FastAPI REST Backend
- Interactive Next.js Dashboard
- 3D Threat Globe & Network Topology
- Comprehensive Pytest Test Suite
- GitHub Actions CI Pipeline
- WebSocket Integration for Live Streaming Alerts
- OAuth2 / JWT User Authentication
- Docker Containerization & Docker Compose
- Deployment to Cloud (AWS / Render / GCP)
- Autoencoder Model for Deep Anomaly Detection
- Multi-tenant Support
- Alerting via Email / Slack Webhooks
- 📂 Repository: GitHub
- 🐛 Report Bugs: Open an Issue
- 💡 GSoC Ideas: See GSoC-Project-Ideas
- 🤝 Contribute: See Contributing
- 📜 License: MIT
This wiki is maintained as part of the GSOC-level documentation standard. All contributors are encouraged to keep it up to date.