How elenacico/ai-security-log-detection works
AI Security Log Detection is a Streamlit SIEM-style analyzer with separate network-anomaly and SSH brute-force engines. Its user workflow accepts an uploaded CSV or live log stream, normalizes the schema, scores telemetry, presents suspicious events, and can request Gemini incident reports. A separate reproducible training workflow prepares data and produces model artifacts consumed by the dashboard. The graph also preserves the documented SSH Isolation Forest fallback. Source excerpts were partial, so uncertain internal dashboard steps are not connected.
Main entry points: 04_app.py SSH scoring · 01_preprocess.py Training preprocessing · 03_train_brute_force_classifier.py Brute-force training · 02_train_isolation_forest.py Isolation Forest training
Components 16
Analysis dashboard
- Streamlit dashboard
04_app.py - Network scoring
04_app.py - SSH scoring
04_app.py - Results and reports
04_app.py
Model training
- Training preprocessing
01_preprocess.py - Isolation Forest training
02_train_isolation_forest.py - Brute-force training
03_train_brute_force_classifier.py
Shared processing
- CSV normalization
csv_normalizer.py - Actor features
brute_force_features.py
Model artifacts
- Network model
isolation_forest_network.pkl - SSH anomaly model
isolation_forest_ssh.pkl - Brute-force model
brute_force_classifier_ssh.pkl
Other components
- Security analyst
- Log data
- Gemini API
- Training datasets
data
Connections 22
- Security analyst → Streamlit dashboard: uploads or enables
- Log data → Streamlit dashboard: provides logs
- Streamlit dashboard → CSV normalization: normalizes CSV
- Streamlit dashboard → Network scoring: routes network logs
- Streamlit dashboard → SSH scoring: routes SSH logs
- Network scoring → Network model: loads model
- SSH scoring → SSH anomaly model: loads fallback
- SSH scoring → Actor features: builds features
- SSH scoring → Brute-force model: loads classifier
- Network scoring → Results and reports: displays findings
- SSH scoring → Results and reports: displays findings
- Results and reports → Security analyst: presents results
- Results and reports → Gemini API: requests reports
- Training preprocessing → Training datasets: reads datasets
- Training preprocessing → CSV normalization: normalizes schema
- Training preprocessing → Isolation Forest training: prepares features
- Isolation Forest training → Network model: saves network model
- Isolation Forest training → SSH anomaly model: saves SSH model
- Brute-force training → Training datasets: reads SSH data
- Brute-force training → Actor features: builds features
- Brute-force training → Brute-force model: saves classifier
- CSV normalization → Gemini API: maps unknown columns