# elenacico/ai-security-log-detection architecture

> Architecture diagram of the GitHub repository elenacico/ai-security-log-detection, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/elenacico/ai-security-log-detection
- Repository: https://github.com/elenacico/ai-security-log-detection

## Overview

AI Security Log Detection is a Streamlit SIEM-style analyzer with separate network-anomaly and SSH brute-force engines. Its user workflow accepts an uploaded CSV or live log stream, normalizes the schema, scores telemetry, presents suspicious events, and can request Gemini incident reports. A separate reproducible training workflow prepares data and produces model artifacts consumed by the dashboard. The graph also preserves the documented SSH Isolation Forest fallback. Source excerpts were partial, so uncertain internal dashboard steps are not connected.

Main entry points: [`04_app.py`](https://github.com/elenacico/ai-security-log-detection/blob/main/04_app.py) (SSH scoring), [`01_preprocess.py`](https://github.com/elenacico/ai-security-log-detection/blob/main/01_preprocess.py) (Training preprocessing), [`03_train_brute_force_classifier.py`](https://github.com/elenacico/ai-security-log-detection/blob/main/03_train_brute_force_classifier.py) (Brute-force training), [`02_train_isolation_forest.py`](https://github.com/elenacico/ai-security-log-detection/blob/main/02_train_isolation_forest.py) (Isolation Forest training)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_dashboard["Analysis dashboard"]
  node_dashboard_app["Streamlit dashboard<br/>[04_app.py]"]
  node_network_scoring["Network scoring<br/>[04_app.py]"]
  node_ssh_scoring["SSH scoring<br/>[04_app.py]"]
  node_incident_view["Results and reports<br/>[04_app.py]"]
end

subgraph group_training["Model training"]
  node_preprocess["Training preprocessing<br/>[01_preprocess.py]"]
  node_isolation_training["Isolation Forest training"]
  node_classifier_training["Brute-force training"]
end

subgraph group_shared["Shared processing"]
  node_normalizer["CSV normalization<br/>[csv_normalizer.py]"]
  node_actor_features["Actor features"]
end

subgraph group_artifacts["Model artifacts"]
  node_network_model["Network model"]
  node_ssh_model["SSH anomaly model"]
  node_brute_model["Brute-force model"]
end

node_analyst(("Security analyst"))
node_log_input["Log data"]
node_gemini{{"Gemini API"}}
node_raw_training_data["Training datasets"]

node_analyst -->|"uploads or enables"| node_dashboard_app
node_log_input -->|"provides logs"| node_dashboard_app
node_dashboard_app -->|"normalizes CSV"| node_normalizer
node_dashboard_app -->|"routes network logs"| node_network_scoring
node_dashboard_app -->|"routes SSH logs"| node_ssh_scoring
node_network_scoring -->|"loads model"| node_network_model
node_ssh_scoring -->|"loads fallback"| node_ssh_model
node_ssh_scoring -->|"builds features"| node_actor_features
node_ssh_scoring -->|"loads classifier"| node_brute_model
node_network_scoring -->|"displays findings"| node_incident_view
node_ssh_scoring -->|"displays findings"| node_incident_view
node_incident_view -->|"presents results"| node_analyst
node_incident_view -.->|"requests reports"| node_gemini
node_preprocess -->|"reads datasets"| node_raw_training_data
node_preprocess -->|"normalizes schema"| node_normalizer
node_preprocess -->|"prepares features"| node_isolation_training
node_isolation_training -->|"saves network model"| node_network_model
node_isolation_training -->|"saves SSH model"| node_ssh_model
node_classifier_training -->|"reads SSH data"| node_raw_training_data
node_classifier_training -->|"builds features"| node_actor_features
node_classifier_training -->|"saves classifier"| node_brute_model
node_normalizer -.->|"maps unknown columns"| node_gemini

click node_dashboard_app "https://github.com/elenacico/ai-security-log-detection/blob/main/04_app.py"
click node_network_scoring "https://github.com/elenacico/ai-security-log-detection/blob/main/04_app.py"
click node_ssh_scoring "https://github.com/elenacico/ai-security-log-detection/blob/main/04_app.py"
click node_incident_view "https://github.com/elenacico/ai-security-log-detection/blob/main/04_app.py"
click node_normalizer "https://github.com/elenacico/ai-security-log-detection/blob/main/csv_normalizer.py"
click node_actor_features "https://github.com/elenacico/ai-security-log-detection/blob/main/brute_force_features.py"
click node_preprocess "https://github.com/elenacico/ai-security-log-detection/blob/main/01_preprocess.py"
click node_isolation_training "https://github.com/elenacico/ai-security-log-detection/blob/main/02_train_isolation_forest.py"
click node_classifier_training "https://github.com/elenacico/ai-security-log-detection/blob/main/03_train_brute_force_classifier.py"
click node_network_model "https://github.com/elenacico/ai-security-log-detection/blob/main/isolation_forest_network.pkl"
click node_ssh_model "https://github.com/elenacico/ai-security-log-detection/blob/main/isolation_forest_ssh.pkl"
click node_brute_model "https://github.com/elenacico/ai-security-log-detection/blob/main/brute_force_classifier_ssh.pkl"
click node_raw_training_data "https://github.com/elenacico/ai-security-log-detection/tree/main/data"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_dashboard_app,node_network_scoring,node_ssh_scoring,node_incident_view toneBlue
class node_preprocess,node_isolation_training,node_classifier_training toneAmber
class node_normalizer,node_actor_features,node_gemini toneMint
class node_network_model,node_ssh_model,node_brute_model toneRose
class node_analyst,node_log_input toneIndigo
class node_raw_training_data toneTeal
```

## Components

### Analysis dashboard

- [Streamlit dashboard](https://github.com/elenacico/ai-security-log-detection/blob/main/04_app.py): `04_app.py`
- [Network scoring](https://github.com/elenacico/ai-security-log-detection/blob/main/04_app.py): `04_app.py`
- [SSH scoring](https://github.com/elenacico/ai-security-log-detection/blob/main/04_app.py): `04_app.py`
- [Results and reports](https://github.com/elenacico/ai-security-log-detection/blob/main/04_app.py): `04_app.py`

### Model training

- [Training preprocessing](https://github.com/elenacico/ai-security-log-detection/blob/main/01_preprocess.py): `01_preprocess.py`
- [Isolation Forest training](https://github.com/elenacico/ai-security-log-detection/blob/main/02_train_isolation_forest.py): `02_train_isolation_forest.py`
- [Brute-force training](https://github.com/elenacico/ai-security-log-detection/blob/main/03_train_brute_force_classifier.py): `03_train_brute_force_classifier.py`

### Shared processing

- [CSV normalization](https://github.com/elenacico/ai-security-log-detection/blob/main/csv_normalizer.py): `csv_normalizer.py`
- [Actor features](https://github.com/elenacico/ai-security-log-detection/blob/main/brute_force_features.py): `brute_force_features.py`

### Model artifacts

- [Network model](https://github.com/elenacico/ai-security-log-detection/blob/main/isolation_forest_network.pkl): `isolation_forest_network.pkl`
- [SSH anomaly model](https://github.com/elenacico/ai-security-log-detection/blob/main/isolation_forest_ssh.pkl): `isolation_forest_ssh.pkl`
- [Brute-force model](https://github.com/elenacico/ai-security-log-detection/blob/main/brute_force_classifier_ssh.pkl): `brute_force_classifier_ssh.pkl`

### Other components

- **Security analyst**
- **Log data**
- **Gemini API**
- [Training datasets](https://github.com/elenacico/ai-security-log-detection/tree/main/data): `data`

## Connections

- Security analyst → Streamlit dashboard: uploads or enables
- Log data → Streamlit dashboard: provides logs
- Streamlit dashboard → CSV normalization: normalizes CSV
- Streamlit dashboard → Network scoring: routes network logs
- Streamlit dashboard → SSH scoring: routes SSH logs
- Network scoring → Network model: loads model
- SSH scoring → SSH anomaly model: loads fallback
- SSH scoring → Actor features: builds features
- SSH scoring → Brute-force model: loads classifier
- Network scoring → Results and reports: displays findings
- SSH scoring → Results and reports: displays findings
- Results and reports → Security analyst: presents results
- Results and reports → Gemini API: requests reports
- Training preprocessing → Training datasets: reads datasets
- Training preprocessing → CSV normalization: normalizes schema
- Training preprocessing → Isolation Forest training: prepares features
- Isolation Forest training → Network model: saves network model
- Isolation Forest training → SSH anomaly model: saves SSH model
- Brute-force training → Training datasets: reads SSH data
- Brute-force training → Actor features: builds features
- Brute-force training → Brute-force model: saves classifier
- CSV normalization → Gemini API: maps unknown columns