Cybersecurity Student · System Administrator · Web Design Learner

Project Overview

AI-Sec is a local-first AI security copilot designed to support security operations in home and small-business environments. Instead of attempting to replace analysts or fully automate decisions, AI-Sec focuses on contextual analysis, alert explanation, and decision support, keeping humans firmly in the loop.

The system ingests security alerts, logs, and system events from monitoring tools (e.g., SIEM, endpoint logs, DNS activity) and uses a locally hosted language model to correlate events, explain potential risk, and recommend next steps. All processing is performed locally to preserve privacy, control, and data ownership.

What It Does (Strong, Real Capabilities)

• Alert Contextualization - Translates raw security alerts into clear, human-readable explanations (what happened, why it matters, what to check next).
• Event Correlation - Analyzes multiple related signals (authentication logs, DNS activity, endpoint events) to surface patterns that may indicate misuse or intrusion.
• Severity & Risk Reasoning - Assists in distinguishing normal behavior from suspicious activity using baseline awareness and contextual clues — without making autonomous enforcement decisions.
• Human-in-the-Loop Response - Provides recommended actions (review, isolate, monitor, ignore) while leaving final decisions to the operator.
• Local-Only Processing - Runs entirely on local infrastructure using self-hosted AI models, avoiding cloud dependency and protecting sensitive data.

Example Use Case

A spike in failed SSH login attempts is detected on a Linux host. AI-Sec correlates the alert with recent network scans and DNS activity, summarizes the behavior, explains likely attack patterns, and recommends reviewing access controls or temporarily restricting access — while preserving logs for investigation.

Architecture (Conceptual)

• Log & alert sources (SIEM, endpoints, DNS, network devices)
• Centralized log ingestion
• Local AI engine (self-hosted LLM)
• Analysis & summarization layer
• Human review interface (CLI or web UI)

Design Principles

• Explainability over automation
• Privacy-first, local execution
• Security judgment over AI hype
• Designed for real operators, not demos

Current Focus

• Local model deployment and performance testing
• Prompt engineering for security reasoning and clarity
• Structured alert input and summarization output
• Defining safe boundaries and limitations for AI recommendations

Planned Enhancements

• Web-based review dashboard
• Custom alert templates for different event types
• Integration with automation workflows (notify, log, restrict access — never fully autonomous)
• Improved correlation across time-based events

Limitations (Important & Impressive)

• Not designed to replace SOC analysts
• Not intended for enterprise-scale environments
• Relies on quality of upstream logs and alerts
• Recommendations require human validation
• (Including this section increases credibility significantly.)