Inspiration
Threat Replay Mode — let users "replay" a past attack visually (like a timeline scrubber) to see exactly how AISS detected and neutralized it — great for demos and training AI Threat Storyteller — have Claude auto-generate a plain-English "incident report" after every neutralized threat, so non-technical stakeholders understand what happened Honeypot Mode — deploy fake vulnerable endpoints/files to lure attackers and feed AISS more training signal Mobile Companion App — push critical alerts (ransomware, C2 traffic) straight to a phone with one-tap "approve auto-response" controls Threat Score Dashboard — a single "Security Health Score" (like a credit score) for the monitored system, trending over time Differentiation Angles Most competitors (SentinelOne, Qualys, IBM) sell to enterprises with big budgets — AISS could lean into being the "threat detection for indie devs & small teams" who can't afford enterprise SOC tools Lead with the <1s detection + zero-human-intervention angle — that's rare even among big players The Claude-powered MITRE ATT&CK mapping is genuinely unique — most tools show what happened, few explain it in structured, human-readable terms automatically Marketing/Portfolio Ideas A short demo video showing the live threat feed reacting in real time (you already have the assets — reuse those CloudFront clips) Write a technical blog post: "How I built a self-healing security system with FastAPI + Claude AI" — great for dev.to/Hashnode, drives GitHub stars Submit AISS to Product Hunt — "AI SOC-in-a-box" is a compelling one-liner
What it does
AISS — AI-Powered Threat Detection & Response Platform Tagline: "Detect. Analyze. Neutralize." A production-grade, autonomous cybersecurity backend that monitors infrastructure 24/7, detects threats in real-time, and automatically responds — no human intervention required. Built with FastAPI, PostgreSQL, and Claude AI. Key Stats 25+ threat types detected 6 detection modules 31 API endpoints <1s detection time 100% cross-platform (Windows & Linux) Core Features Threat Detection — Real-time monitoring of network, auth, file, and process activity Auto Response — Automatically blocks malicious IPs, kills malicious processes, quarantines files AI Analysis — Claude AI maps threats to MITRE ATT&CK, extracts IOCs (Indicators of Compromise), and generates step-by-step response plans PostgreSQL Storage — Persists all data (threats, users, blocked IPs, scan results) via SQLAlchemy ORM, survives restarts JWT Authentication — Bcrypt-hashed passwords, role-based access (admin/analyst/viewer), account lockout protection WebSocket Feed — Real-time threat notifications pushed instantly to connected clients Detection Modules (6, running in parallel every 5 seconds) Network Monitor Auth Guard File Inspector Malware Scanner AI Analyst Response Engine What It Defends Against Network & Auth attacks: port scans, C2 (command-and-control) traffic, DNS hijacking, ARP spoofing, brute force Malware & files: cryptominers, ransomware, trojans, rootkits, keyloggers — identified via process signatures, file hashes, and behavioral patterns, then quarantined instantly Response Engine When a threat is confirmed, it acts immediately: blocks IPs via Windows Firewall or iptables, kills malicious processes, quarantines files, flushes DNS — fully automated. Site Structure Home | Monitor | Features | About | Kill Chain | Importance | Docs | Our Team | Contact
How we built it
When we set out to build AISS, the goal wasn't just another security dashboard — it was a system that could actually act on threats, not just alert on them. Most tools stop at detection and leave a human to decide what to do next. We wanted something closer to an autonomous immune system for infrastructure. Starting with the backend We built the core on FastAPI because we needed speed — both in development and in runtime response. Every millisecond matters when you're trying to stop ransomware before it finishes encrypting files. FastAPI's async support let us run multiple detection modules in parallel without blocking each other. For persistence, we went with PostgreSQL and SQLAlchemy ORM. Threats, users, blocked IPs, and scan results all needed to survive restarts — a security tool that forgets its history after a reboot isn't much of a security tool. Designing the detection layer Instead of one monolithic scanner, we split detection into 6 independent modules running every 5 seconds: Network Monitor, Auth Guard, File Inspector, Malware Scanner, AI Analyst, and the Response Engine. Each watches a different attack surface — network traffic, login attempts, file changes, running processes — so nothing slips through a single blind spot. Bringing in AI This is where Claude AI became central to the system. Raw detection tells you something is wrong — Claude tells you what it means. For every confirmed threat, it maps the behavior to MITRE ATT&CK techniques, extracts IOCs (Indicators of Compromise), and generates a step-by-step response plan. That turned AISS from a rule-based scanner into something that reasons about threats the way an analyst would. Making response automatic Detection alone wasn't the point — we wanted zero-human-intervention response. So the Response Engine acts the moment a threat is confirmed: blocking IPs via Windows Firewall or iptables, killing malicious processes, quarantining infected files, flushing poisoned DNS entries. No waiting for someone to be online at 3 AM. Security around the security tool Since AISS itself handles sensitive data, we locked it down with JWT authentication, bcrypt-hashed passwords, role-based access (admin/analyst/viewer), and account lockout protection — because a security platform with weak auth defeats its own purpose. Keeping users in the loop Finally, we wired up a WebSocket feed so every connected client sees threats the instant they happen — no polling, no refresh delay. Watching the live feed light up during a simulated attack was genuinely the moment it felt real. The result 25+ threat types covered, sub-second detection, fully cross-platform across Windows and Linux — a system that doesn't just watch, it fights back.
Challenges we ran into
Challenges We Ran Into False positives were the first wall we hit Early on, the Network Monitor flagged legitimate traffic spikes as brute-force attempts, and the File Inspector treated normal backup jobs as ransomware activity. We had to spend real time tuning thresholds and adding behavioral baselines instead of relying on hard-coded rules — otherwise the system would "cry wolf" so often that auto-response became dangerous rather than helpful. Auto-response is a double-edged sword Letting the system block IPs and kill processes with zero human intervention sounds great — until it kills the wrong process. We had a scare in testing where a legitimate admin SSH session got flagged as a brute-force pattern and nearly got auto-blocked. That forced us to build in smarter context checks (known-good IP allowlisting, session history) before the Response Engine takes irreversible action. Running 6 modules in parallel without starving resources Scanning network, auth, files, and processes every 5 seconds, across both Windows and Linux, is resource-hungry. We had to profile and optimize each module so AISS itself didn't become the thing hogging CPU/memory on the systems it was supposed to protect. Cross-platform behavior differences Windows and Linux handle processes, firewalls, and file permissions very differently. Iptables vs. Windows Firewall, different log formats, different privilege models — we ended up writing platform-specific adapters behind a common interface instead of one "universal" script, which took longer but was the only way to keep detection accurate on both OSes. Making Claude's output actionable, not just descriptive Early AI Analyst responses were accurate but too verbose — good for a report, useless for someone needing to react in seconds. We had to iterate on prompting so Claude's output consistently produced structured, scannable output (MITRE mapping, IOCs, response steps) instead of paragraphs of explanation. Keeping the WebSocket feed reliable under load When multiple threats fired close together, some clients would miss events or get them out of order. We had to add proper event queuing and reconnect logic so the live feed stayed trustworthy — a security dashboard that silently drops alerts is worse than no dashboard at all. Balancing speed vs. certainty The whole pitch is sub-1-second detection, but acting too fast on unconfirmed signals risks false positives; acting too slow defeats the purpose. Tuning that trade-off — how much evidence is "enough" before triggering an automatic response — was an ongoing balancing act, not a one-time fix.
Accomplishments that we're proud of
Accomplishments We're Proud Of Sub-1-second detection, actually working Getting real-time detection under 1 second — across 25+ threat types, running 6 modules in parallel — wasn't just a marketing number. Watching the live threat feed catch a simulated ransomware attack and neutralize it before meaningful damage occurred was the moment we knew the architecture actually held up under pressure. Zero-human-intervention response that we could trust After all the false-positive tuning and safety guardrails, we got to a point where we could genuinely let the Response Engine act on its own — blocking IPs, killing processes, quarantining files — without babysitting it. That trust took real engineering to earn. Making AI explain itself, not just flag things We're especially proud of the Claude-powered analysis layer. Turning a raw alert into a MITRE ATT&CK-mapped, IOC-extracted, step-by-step response plan means AISS doesn't just say "something's wrong" — it explains what, how bad, and what to do, the way a real analyst would. That's the part that elevates it above a typical rule-based scanner. True cross-platform coverage Getting consistent detection and response behavior across both Windows and Linux — despite completely different firewall systems, process models, and log formats — was genuinely hard, and getting it to 100% cross-platform coverage felt like a real milestone. A system that survives restarts and scales Persisting everything through PostgreSQL with SQLAlchemy, plus proper JWT auth and role-based access, meant AISS grew from a prototype script into something that actually behaves like production infrastructure — not a demo that breaks the moment you reboot it. Real-time visibility that people can trust The WebSocket live feed — after fixing the reliability issues — became one of the most satisfying parts to demo. Watching threats appear, get analyzed, and get resolved in real time, instantly, made the whole system feel alive rather than theoretical. Built lean, without a big team Maybe the thing we're most proud of: this is a production-grade autonomous security platform — 31 API endpoints, 6 detection modules, full auth, real AI reasoning — built by a small team, not a funded enterprise security company.
What we learned
What We Learned Detection and response are two completely different problems Building something that notices a threat is one challenge. Building something that can be trusted to act on that threat automatically is a much harder one. We learned to treat them as separate engineering problems with separate risk tolerances — detection can afford to be a little noisy, response cannot. Security tools need their own security Building AISS made it obvious how much a monitoring system becomes a high-value target itself — if someone compromises the tool watching your infrastructure, they own everything. That's why JWT auth, bcrypt hashing, and role-based access weren't an afterthought; they became as important as the detection logic itself. AI is best as a reasoning layer, not a decision-maker We learned to use Claude for what it's genuinely good at — explaining, mapping to MITRE ATT&CK, extracting IOCs, structuring a response plan — rather than letting it make the final call on whether to block or kill something. The deterministic modules decide what happened; AI helps explain what it means. Keeping that boundary clear made the system both more reliable and easier to reason about. Cross-platform is never "just an adapter" We went in thinking Windows vs. Linux support would mostly be a thin translation layer. It wasn't — different privilege models, different firewall paradigms, different log structures meant real platform-specific logic. We learned to design the common interface after understanding both platforms deeply, not before. Real-time systems fail in ways batch systems don't The WebSocket feed issues taught us that "real-time" isn't just about speed — it's about ordering, delivery guarantees, and reconnection handling. A dropped alert in a security tool isn't a minor bug; it's a missed attack. Tuning is never really "done" False positives taught us that threat detection isn't a one-time calibration — it's an ongoing feedback loop. We learned to build AISS with tuning and adjustment in mind from the start, rather than treating thresholds as fixed constants. Small teams can build production-grade security tools Maybe the biggest lesson: you don't need an enterprise security company's resources to build something genuinely capable. Careful architecture, clear module boundaries, and letting AI carry the reasoning load let a small team punch well above its weight.
What's next for AISS
What's Next for AISS Threat Replay & Visual Timeline A way to scrub back through a past incident — see exactly what each module detected, when, and how the Response Engine reacted — step by step. Huge for demos, training, and post-incident reviews. Mobile Companion App Push critical alerts (ransomware, C2 traffic) straight to a phone, with one-tap approve/deny on auto-response actions for cases where a human wants final say. Honeypot Mode Deploy decoy vulnerable endpoints and files to lure attackers in — not just defending real assets, but actively harvesting attacker behavior to make the Malware Scanner and AI Analyst smarter over time. Adaptive Learning from False Positives Right now, tuning is manual. The next step is closing that loop — letting AISS learn from confirmed false positives automatically and adjust its own thresholds over time instead of requiring us to retune it by hand. Security Health Score A single trending score — like a credit score for infrastructure — so non-technical stakeholders can see at a glance whether their system's posture is improving or degrading over time, without reading raw threat logs. Expanding threat coverage beyond 25+ Cloud-native threats (misconfigured S3 buckets, IAM privilege escalation, container escapes) are a natural next attack surface as more infrastructure moves off bare Windows/Linux boxes. Multi-node / fleet monitoring Right now AISS protects a system. The next evolution is protecting a fleet — correlating threats across multiple machines to catch coordinated or lateral-movement attacks that look harmless on any single node. Public API & integrations Opening up the 31 endpoints for integration with existing SIEM tools, Slack/Discord alerting, and ticketing systems (Jira, PagerDuty) — so AISS can slot into teams' existing workflows instead of requiring them to live in a new dashboard. Community & open contribution Since the backend is already on GitHub, formalizing it for outside contributors — detection module templates, a plugin system for custom threat signatures — could turn AISS from a solo/small-team project into something with real community momentum.
Log in or sign up for Devpost to join the conversation.