CloudEcoLens_Pandas

Technical Methodology
Datasets for Machine Learning
Load Inefficiency (HGBR, Isolation Forest, Rules, Rolling Z-Score)
Attack Paths (Identified using Graphing Algorithms)
Forecasting (AutoARIMA Machine Learning Algorithm)
AI Recommendations (LLM Fine-tuned in Cyber + Sustainability)

Inspiration

While speaking with HILTI employees, Jared Ee and Alan Chong, we learned that construction companies often treated security, cost, and sustainability as separate problems, meaning they manage security, cost, and sustainability in different platforms/tools. This makes it hard to see which resources are not only expensive or inefficient, but also part of dangerous attack paths.

Furthermore, discussing with the HILTI mentors also taught me that these problems are actually intertwined with each other. An idle or misconfigured cloud resource can only waste money, emit avoidable carbon, and create security vulnerabilities.

Thus, this is why we built CloudEcoLens.

What it does

CloudEcoLens solves the main problem by providing one unified scan that connects cloud resource telemetry, security posture, cost impact, and carbon impact. CloudEcoLens does this by scanning AWS resources for inefficiencies, anomalies, and security weaknesses.

First, it uses custom-trained ML models (HGBR, Isolation Forest) and pre-defined rule-sets to identify load inefficiencies. It then proposes practical ways to solve each detected inefficiency by using a fine-tuned LLM (Gemini 2.5 Flash) trained on sustainability policies.

Next, it uses a graph traversal algorithm (depth-limited DFS) to build and simulate attack paths across IAM, network, EC2, and S3 relationships. It also ranks each potential attack path using graph algorithms like PageRank. Recommendations on preventing these cyber attacks are also provided by a fine-tuned LLM (Gemini 2.5 Flash) trained on cybersecurity practices.

CloudEcoLens then uses another custom-trained predictive AI model (AutoARIMA) to forecast future demand, cost, emissions, and capacity headroom. Once again providing specific AI recommendations on how to configure AWS resources according to forecasts using a fine-tuned LLM (Gemini 2.5 Flash) trained on sustainability policies.

How we built it

Refer to the Technical Methodology graphic attached for a graphical representation of the technical details.

We built a FastAPI backend with a Next.js dashboard, using LocalStack to simulate AWS EC2, S3, IAM, CloudWatch, and event logs. We also trained custom ML models with scikit-learn and statsforecast. Moreover, we used NetworkX for attack path graph traversal and ranking. Lastly, we fine-tuned Gemini with modern sustainability policies and cybersecurity practices to make it an expert in these fields, finally integrating Gemini with BM25 retrieval for grounded explanations and recommendations.

Challenges we ran into

One of the main challenges we faced was successfully implementing both security and sustainability into one clean workflow. These areas are normally treated as separate areas and the reason no one has done this before is because of how hard it is to connect everything in a way that would be natural. We had to show how cloud waste, carbon impact, misconfigurations, and attack paths all relate to the same underlying infrastructure.

We eventually did this by truly discussing and understanding the problem from the user's shoes. We looked at these disconnected areas from the user perspective and focused on connecting them into a flow that users could easily understand both the security risk and sustainability impact of each finding.

Accomplishments that we're proud of

We are proud to have connected cloud waste, carbon impact, and attack-path risk into one product flow that feels intuitive for potential users. We are also proud that we used real public telemetry datasets to train custom machine learning models for efficiency detection, anomaly detection, and forecasting.

Another accomplishment was building a specialized GenAI layer grounded in sustainability and cybersecurity context, helping users understand findings and generate remediation guidance. Most of all, we are proud that we built a fully working prototype with a backend, ML sidecar, graph analysis, and GenAI workflow that we believe can make a meaningful difference.

What we learned

We learned that graph traversal and a graphical representation makes IAM/network misconfigurations much easier to explain. We showed the graphs generated in attack paths to some hackathon mentors and all of them agreed that this unique way of showcasing cyber attacks makes it easier for non-technical people to understand and come up with solutions to stop potential attacks.

We also learned that LLMs are most useful when grounded in structured findings and constrained outputs as this prevents hallucinations and allows responses to be of much higher quality. Moreover, fine-tuning LLMs using context-specific data really allows the LLM to become an expert in a given area, allowing for another boost in response quality.

What's next for CloudEcoLens_Pandas

We plan to add real AWS integration, with the long-term goal of expanding to Azure and GCP as well. From a business perspective, CloudEcoLens could operate as a SaaS platform for cloud-heavy organizations, offering tiered pricing based on the number of cloud resources scanned, forecast horizon, and remediation automation features.

For construction firms, this could become a compliance and optimization tool that helps teams reduce cloud spend, lower reported emissions, and improve security posture across project environments. Future premium features could include executive ESG reporting and multi-cloud risk benchmarking.