AfriShield Assistant

• 

• 

• 

• 

• 

• 

• 

Inspiration

AfriShield AI was inspired by a practical problem we observed across Africa: access to cybersecurity assistance often depends on reliable internet connectivity, technical expertise, and expensive security tools.

Individuals, students, small businesses, and organizations increasingly face phishing, scams, account takeovers, malware, ransomware, identity theft, and financial fraud. Yet many users do not have immediate access to cybersecurity professionals when an incident occurs.

We wanted to build something that could provide useful cybersecurity intelligence locally, privately, and with minimal dependence on the internet.

That idea became AfriShield AI — an offline-first AI cybersecurity assistant designed with African users and real-world constraints in mind.

What it does

AfriShield AI allows users to describe a suspicious message, security concern, or active cyber incident and receive an AI-assisted security analysis.

The system can:

• Detect common cyber threats such as phishing, malware, ransomware, account compromise, financial fraud, data breaches, and DDoS attacks.
• Analyze suspicious messages for potential scams.
• Determine whether a user is asking a general security question or reporting an active incident.
• Retrieve relevant information from a local cybersecurity knowledge base using RAG.
• Generate security guidance using a locally running Llama 3.2 model.
• Provide incident-response recommendations.
• Assign threat severity and confidence levels.
• Display matched threat signals to improve explainability.
• Log detected incidents.
• Process multilingual input through its language detection and translation layer.
• Continue operating without depending on a cloud AI API.

The system combines these capabilities into a single pipeline:

User
 ↓
Language Detection / Translation
 ↓
Threat & Scam Detection
 ↓
RAG Knowledge Retrieval
 ↓
Local LLM
 ↓
Incident Response
 ↓
Translated Response
 ↓
User

How we built it

We built AfriShield AI as a modular Python application using Streamlit for the interface and a locally running Llama 3.2 model for AI generation.

The major components include:

• Local LLM — provides AI responses without requiring a cloud AI service.
• RAG pipeline — retrieves relevant cybersecurity knowledge before generating responses.
• ChromaDB — stores and retrieves the local vectorized knowledge base.
• Threat Detection Engine — uses cybersecurity indicators, fuzzy matching, phrase matching, lightweight stemming, and intent detection.
• Scam Detection Engine — identifies suspicious scam patterns.
• Incident Response Engine — provides recommended actions based on detected threats.
• Language Layer — detects and translates supported languages while maintaining a canonical interpretation for the security pipeline.
• Incident Logger — records detected security incidents.
• Streamlit Dashboard — brings the different components together in an accessible interface.

We designed the system so that deterministic cybersecurity engines perform analysis before the LLM generates its response. This allows the AI to assist with security analysis without relying entirely on a generative model for threat classification.

Challenges we ran into

One of our biggest challenges was building an AI system that could work offline.

Using cloud AI APIs would have simplified development, but it would also introduce internet dependency, privacy concerns, recurring costs, and potential connectivity problems. Running a local LLM required us to consider hardware resources, startup time, model performance, and response latency.

Another challenge was threat detection. Real users do not always describe incidents using standard cybersecurity terminology. They may use slang, abbreviations, spelling mistakes, or local expressions.

To address this, we implemented techniques including fuzzy matching, lightweight stemming, phrase matching, expanded African cyber-fraud vocabulary, and intent detection.

Multilingual cybersecurity processing was also challenging because translating cybersecurity terminology incorrectly can change the meaning of an incident. We therefore designed the language layer to sit in front of the existing AI pipeline while preserving a canonical interpretation of the user's message.

Finally, integrating multiple independent components into one reliable application required careful modularization and error handling.

Accomplishments that we're proud of

We are particularly proud that we were able to build a working offline-first cybersecurity AI platform rather than just a prototype chatbot.

Our major accomplishments include:

• Building a local AI cybersecurity assistant.
• Integrating a complete RAG pipeline.
• Creating a cybersecurity knowledge base.
• Developing a dedicated threat detection engine.
• Implementing scam detection.
• Implementing incident-response recommendations.
• Adding threat severity and confidence classification.
• Adding explainability through matched signals and analysis details.
• Adding incident logging.
• Integrating language detection and translation into the AI pipeline.
• Building a functional Streamlit dashboard.
• Designing the system to operate without depending on external AI APIs.
• Preparing the project as an open-source GitHub repository.

Most importantly, we successfully combined AI generation, retrieval, deterministic cybersecurity analysis, and incident response into one application.

What we learned

This project taught us that building an AI cybersecurity system requires much more than connecting a language model to a chat interface.

We learned how to:

• Build and integrate a local LLM pipeline.
• Implement Retrieval-Augmented Generation.
• Create and manage a local vector database.
• Develop cybersecurity detection logic.
• Combine deterministic algorithms with generative AI.
• Design AI systems with explainability in mind.
• Build multilingual processing into an existing AI pipeline.
• Handle errors between independent application components.
• Optimize an AI application for local/offline execution.
• Use Git and GitHub effectively during an extended development project.

One of our most important lessons was that AI should assist cybersecurity analysis rather than blindly make every security decision.

Using specialized detection engines alongside RAG and a local LLM gives the system a more structured and controlled approach to cybersecurity assistance.

What's next for AfriShield Assistant

AfriShield AI is designed as a foundation rather than a finished product.

Our next priorities include expanding support for more African languages, improving translation quality, expanding the cybersecurity knowledge base, and improving local model performance and response speed.

We also plan to explore:

• More African language support, including Hausa, Yoruba, Igbo, Swahili, and French.
• Improved offline translation models.
• More advanced threat intelligence.
• Continuous updates to the local cybersecurity knowledge base.
• Stronger phishing and scam detection.
• Mobile and lightweight deployment options.
• More detailed incident dashboards.
• Organization-level deployment for schools and small businesses.
• Improved benchmarking and performance optimization.
• Integration with additional offline security tools.

Our long-term vision is to make AfriShield AI a practical, accessible, and resilient cybersecurity assistant for African users — providing useful security intelligence even when reliable internet access is unavailable.

Built With

• 3.2
• ai
• artificial
• chromadb
• cybersecurity
• database
• generative
• git
• intelligence
• language
• learning
• llama
• llm
• local
• machine
• natural
• offline
• processing
• python
• rag
• streamlit
• vector