How lina123-alt/ai-cyber-soc works
AI-Cyber-SOC is a Flask SOC dashboard: an operator views traffic-derived risk summaries, can ask contextual security questions, request a simulated IP ban, or inject synthetic attacks. The main analysis stages are log-pattern parsing, per-IP feature aggregation, ML risk scoring, and dashboard/report presentation. Model training and synthetic-data generation are separate supporting capabilities. Source excerpts show the app calling the analyzer, simulator, and Gemini; they do not establish all storage wiring. In particular, referenced log and training-data paths differ from files in the tree.
Main entry points: app.py Flask routes · analyzer.py Log analysis · report.html SOC dashboard · loading.html Loading screen
Components 14
SOC web app
- Flask routes
app.py - SOC dashboard
report.html - Loading screen
loading.html - Ban IP endpoint
app.py - Cyber Q&A
app.py - Ban confirmation
app.py
Threat analysis
- Log analysis
analyzer.py - Pattern detection
analyzer.py - Per-IP risk scoring
analyzer.py
ML support
- Random Forest training
ml_model.py - Synthetic dataset generation
generate_dataset.py
Attack simulation
- Attack simulator
simulate_attacks.py
Other components
- SOC operator
- Gemini API
Connections 14
- SOC operator → Flask routes: opens dashboard
- Flask routes → Log analysis: analyzes logs
- Log analysis → Pattern detection: parses patterns
- Log analysis → Per-IP risk scoring: scores IPs
- Flask routes → SOC dashboard: renders report
- SOC operator → Cyber Q&A: asks question
- Cyber Q&A → Log analysis: gets statistics
- Cyber Q&A → Gemini API: requests analysis
- Gemini API → Cyber Q&A: returns answer
- SOC operator → Ban IP endpoint: requests ban
- Ban IP endpoint → Ban confirmation: returns confirmation
- SOC operator → Flask routes: opens loading
- Flask routes → Loading screen: renders screen
- Flask routes → Attack simulator: runs simulation