AI Impersonation Incident Correlation Platform

Inspiration

AI has changed how impersonation attacks are carried out. Attackers can use AI-generated phishing emails, cloned voices, synthetic images/videos, and compromised accounts to make malicious requests appear trustworthy.

Our main inspiration was the fact that one impersonation attack can generate multiple security signals across different systems. An employee might receive a suspicious email supposedly from a CEO, followed by a cloned voice message and an unusual login from the same account.

Instead of investigating these alerts separately, we wanted to answer one question:

Are these separate alerts — or one coordinated impersonation incident?

This motivated us to build a platform focused on connecting these signals into one understandable incident.

What it does

The AI Impersonation Incident Correlation Platform connects suspicious signals from multiple channels, including:

Email Audio / voice Image / video Login and authentication activity

Each signal is analyzed individually. Our correlation engine then compares identity, timestamp, event type, risk, and context to identify relationships between events.

The platform generates a consolidated incident with:

Cross-channel correlation Prototype incident-risk assessment Incident timeline Evidence and risk factors SOC investigation view Suggested next actions

Our goal is not to build another standalone deepfake detector. Instead, we connect existing detection signals to help identify potential coordinated AI-impersonation incidents.

How we built it

We built the prototype using:

Frontend: HTML, CSS, JavaScript Backend: Python + Flask Database: SQLite / simulated security events Media Analysis: Reality Defender API Core: Correlation + Risk Engine

Our workflow is:

Collect → Analyze → Correlate → Assess → Investigate

We collect suspicious media, email, and authentication events. Individual signals are then analyzed, followed by correlation based on identity, timestamps, event type, risk, and context.

For media analysis, we use the Reality Defender API to provide a media authenticity signal. Our platform then performs the cross-channel correlation, incident-risk assessment, timeline generation, and SOC investigation workflow.

Challenges we ran into

One of our main challenges was connecting different types of security signals into a single meaningful incident.

Email, media, and authentication events have different formats and characteristics, so we needed a common correlation approach based on factors such as identity, time, event type, and context.

Another challenge was clearly separating existing technology from our own contribution. Instead of claiming to replace existing media-analysis tools, we used their signal as an input and focused our development on correlation, risk assessment, incident timelines, and SOC investigation.

We also had to make the prototype practical and demonstrable within the hackathon timeframe. Therefore, we used simulated email and login events together with API-based media analysis.

Accomplishments that we're proud of

We are proud that we turned a complex cybersecurity problem into a working, demonstrable incident-correlation workflow.

Our key accomplishments include:

Connecting multiple security signals into one incident Integrating media analysis through an external API Building a correlation engine using identity and time-based context Creating an explainable prototype risk assessment Generating an incident timeline Building a SOC-oriented investigation workflow Clearly separating existing technology from our own contribution

For example, when high-risk media, email, and login signals are associated with the same identity within a short time window, our platform can correlate them into a potential AI-impersonation incident.

What we learned

This project taught us that cybersecurity is not only about detecting individual threats. The relationship between multiple security signals can provide important investigation context.

We learned about:

AI impersonation threats Media authenticity analysis Security-event correlation Authentication anomalies Incident timelines Explainable risk assessment SOC investigation workflows API integration Flask-based backend development Working with simulated security-event data

One of our biggest lessons was that security analysts need context, not just individual alerts. Combining identity, timestamps, event types, and risk indicators can make investigation more structured and understandable.

What's next for AI Impersonation Incident Correlation Platform

Our next step is to move beyond the prototype and support more real-world security environments.

Potential improvements include:

Integration with real email-security systems Integration with identity and authentication platforms More media-analysis providers Real-time event ingestion Advanced correlation rules Improved risk assessment Automated incident prioritization Integration with existing SIEM/SOC platforms More detailed analyst investigation and response workflows

Ultimately, our goal is to help security teams move from simply detecting suspicious content to understanding the complete incident around it.