Trained on 15 public network corpora — CIC-IDS 2017, 2018, and three IoT datasets — visualized live in the AEGIS Command Centre.
Runtime RF inference endpoint status — 28 lag features, 9,464 training rows, MAE 0.1187, serving predictions at /api/infer in milliseconds.
ATT&CK technique mapping per incident — heuristic confidence scoring applied to 4,558 records for tactic and technique attribution.
Unified SOC view — real-time risk posture, live dispatch queue, and autonomous pipeline status across all active tenants.
XGBoost early-warning model output — escalation probability scored per interval using lag features extracted
Deterministic hybrid risk score: 0.35×Forecast + 0.35×Activity + 0.15×Duration + 0.15×Persistence — computed over 4,558 incident records
1-minute network state snapshots with observed anomaly flags — the raw telemetry that feeds every downstream phase.
Real-time packet capture via Scapy + Npcap, replayed against the pipeline as live telemetry — bridging historical training
Threat episodes auto-grouped from risk triggers ≥30, with 3-minute cooldown windows and 60-second gap severance —
Kinematic memory store — past episodes indexed by feature similarity (70% kinematic + 30% MITRE Jaccard) for pattern-based threat matching.
15-dataset ingestion pipeline — CIC-IDS 2017, CIC-IDS 2018 (10 daily files),CIC-IoT-DIAD 2024, CIC-BCCC-Tabular-IoT 2024, CIC-APT-IIOT 2024.
Simulation of unmitigated threat trajectories — what the risk curve would have looked like if no countermeasure had been dispatched.
Per-episode forensic record — flagged intervals, risk trajectory, contributing features, and analyst false-positive feedback via POST .
Phase 7 verification records — end-to-end audit trail from raw telemetry to confirmed countermeasure execution, per episode, per tenant.

Inspiration

Existing security tools are reactive by design — they alert you after a threat has already established itself. We wanted to flip that. The idea behind AEGIS was simple: what if a system could read the early signals of an attack, score the risk before it peaks, and act on it autonomously? That question, combined with the availability of rich public network datasets and modern ML infrastructure, is what set this project in motion.

What it does

AEGIS is a predictive cyber defense platform that runs a fully autonomous 7-phase pipeline — from live network telemetry ingestion to verified countermeasure execution. It forecasts escalation risk using an XGBoost early-warning model, scores threats through a deterministic hybrid formula, groups activity into investigation episodes, matches new threats against past attack patterns using kinematic memory, and simulates counterfactual outcomes before dispatching a response. Every phase feeds the next, closing the loop without human intervention.

How we built it

The pipeline is trained across 15 real-world network datasets spanning general intrusion detection (CIC-IDS 2017, 2018) and IoT-specific corpora. The backend is a FastAPI service with a runtime Random Forest inference model, multi-tenant architecture, and a false-positive feedback loop. The frontend dashboard is built in React and deployed on Vercel. We used Nebius infrastructure with NVIDIA GPU acceleration for model training and real-time inference, making it fast enough to operate inside an active SOC environment.

Challenges we ran into

Unifying 15 heterogeneous datasets into a single coherent pipeline without leaking future information across phases was harder than expected. Building meaningful episode detection — knowing when one threat ends and another begins — required careful tuning of cooldown windows and gap thresholds. Getting multi-tenant data isolation right without introducing a database (staying file-based throughout) also forced creative architecture decisions.

Accomplishments that we’re proud of

A fully working end-to-end pipeline — from raw packets to verified dispatch — running on real public datasets. A runtime inference endpoint that returns escalation predictions in milliseconds. A counterfactual simulation engine that shows what would have happened if a threat went unaddressed. And a live packet capture module that bridges the gap between historical training and real network traffic.

What we learned

That the hardest part of building a security product isn’t the ML — it’s the data engineering. Keeping phases cleanly separated, maintaining compliance labels at every output, and building for multi-tenancy from the start rather than retrofitting it are lessons we’ll carry forward.

What’s next for AEGIS

Real firewall and SIEM integrations, enterprise RBAC and SSO, a model retraining pipeline that learns from flagged false positives, and a FAISS-backed vector memory store for faster episode matching at scale. The eventual target: IoT and OT security, where autonomous response time matters most and human-in-the-loop is often not an option.