4SIC | Devpost

Inspiration

Modern cybersecurity systems generate massive volumes of logs, making it extremely difficult for analysts to manually investigate incidents. While SIEM tools are effective at detecting anomalies, they fall short when it comes to explaining how an attack actually occurred.

We were inspired by real-world breaches where alerts were ignored due to overload, or where attackers erased logs to hide their tracks. This exposed a critical gap: detection exists, but reliable forensic reconstruction and proof do not.

4SIC was built to solve this problem — moving from detection → verifiable cyber forensics.

What it does

4SIC is an AI-powered cyber forensic platform that analyzes system logs (EVTX, CSV) to detect anomalies, identify suspicious activities, and reconstruct complete attack timelines.

Users can upload logs, and the system automatically:

Detects abnormal behavior and potential threats
Identifies key attack stages such as privilege escalation and lateral movement
Reconstructs the full attack sequence
Highlights critical and suspicious log entries

Additionally, 4SIC generates court-ready forensic reports in PDF format, ensuring findings are legally usable and easy to understand.

It also includes:

End-to-End Encrypted Communication for investigators
SIEM integration for enhanced analysis

How we built it

We built 4SIC using a combination of AI models, backend systems, and secure architecture:

Log Processing

Parsed EVTX and CSV logs into structured data

Machine Learning Models

Isolation Forest → anomaly detection
Bi-LSTM → temporal attack pattern analysis

Backend Stack

FastAPI + Python
PostgreSQL (database)
Redis (caching & performance)

Frontend

Dashboard for uploading logs and visualizing results

Security Layer

Tamper-resistant log handling
End-to-end encrypted chat system

Reporting Engine

Automated PDF generation for forensic reports

Challenges we ran into

Handling large-scale log data without performance issues
Converting unstructured logs into meaningful insights
Designing models that provide explainability, not just detection
Ensuring data integrity and preventing tampering
Building a clear and understandable attack timeline
Generating reports that are both technical and legally interpretable

Accomplishments that we're proud of

Reduced manual log analysis from days → seconds
Built AI models that go beyond detection to attack reconstruction
Generated court-ready forensic reports automatically
Implemented secure, encrypted communication for investigators
Designed a scalable system capable of handling real-world data

What we learned

The gap between detection and investigation is significant
Explainable AI (XAI) is critical in cybersecurity
Log analysis at scale requires both efficient architecture + intelligent models
Evidence integrity is as important as detection accuracy
Clear reporting improves real-world usability