Inspiration
Traditional cybersecurity is often reactive—defenders are forced to act only after an alert has been triggered. We wanted to change this by applying advanced predictive mathematics to cybersecurity. Our goal was to build a system that doesn't just tell you an attack is happening, but calculates exactly how severe it will become over the next few minutes. This allows defense systems and analysts to stay one step ahead and dynamically scale their protections in advance.
What it does
Our solution is a real-time analytics and predictive threat intelligence engine. Instead of merely plotting historical data, it ingests live logs (e.g., failed logins) in rapid 10-second windows and uses a mathematical engine to forecast the immediate future.
The dashboard features:
Real-time Threat Estimation: Filters out the noise in raw data to calculate the true, underlying threat level.
Predictive Forecasting: Estimates the expected attack volume for the next 4 minutes.
Worst-Case Scenario: Calculates the 95th percentile of risk, giving defenders a concrete maximum threshold to prepare for.
Escalation Probability: Analyzes data patterns to warn if an attack is escalating beyond normal background noise.
How we built it
We built a decoupled architecture separating the heavy mathematics from the visualization:
The Analysis Engine (Backend): Built in Python using NumPy and Pandas. We implemented a Sequential Monte Carlo Particle Filter to estimate the hidden threat state. Based on this, it runs 2,000 parallel Monte Carlo simulations projecting 24 steps into the future.
The API Server: A blazing-fast FastAPI interface that handles the data flow, triggers the analysis pipeline, and serves the results.
The Frontend: A React-based web dashboard (built with Lovable) using Recharts. It fetches data every 10 seconds, creating a rolling real-time view where history and future predictions blend seamlessly.
Challenges we ran into
The "Right-Edge Problem": With 10-second updates, the most recent data window was often incomplete, causing the model to falsely assume the attack was subsiding. We solved this by intelligently dropping the ongoing, unfilled window from the pipeline.
Data Merging for the UI: Combining historical raw data, historical model estimations, and future predictions into a single chronological array without breaking the React components required meticulous data wrangling in Python.
Escalation Sensitivity: The natural noise level in 10-second intervals is high, which initially caused our escalation gauge to trigger too frequently. We developed dynamic statistical thresholds (incorporating standard deviations and intensity multipliers) to ensure the system only warns of actual, dangerous escalations.
Model Optimation: Setting the right mathematical model and tuning the parameters to the best.
Accomplishments that we're proud of
Sub-second Simulations: We successfully optimized the Python backend to run 2,000 parallel simulations (24 steps into the future) fast enough to support a responsive dashboard updating every 10 seconds.
Visual Proof of Prediction: We managed to plot the model's historical forecasts over the actual historical data (out-of-sample testing). This visually proves that the engine works and anticipates spikes before they occur.
From Math to UI: Taking highly complex concepts like particle filters and transforming them into an intuitive, clear, and beautiful overview that a SOC (Security Operations Center) analyst can instantly understand.
What we learned
Advanced real-time time-series manipulation and formatting using Pandas.
How to calibrate stochastic models to make the algorithm react naturally and quickly to sudden attack waves (like APTs).
Handling asynchronous state management and disabling automated animations in React/Recharts to create a flawless, sliding real-time chart similar to an EKG monitor.
What's next for Quantitative Cyber Threat Detector
SIEM Integration: Connecting the system directly to real network streams (like Splunk, Elastic, or syslog) instead of synthetic logs.
Multi-Dimensional Risk: Expanding the model to factor in attack severity and IP reputation, not just attack volume.
Automated Defense Triggers: Linking the system's warning levels directly to a firewall or cloud API to automatically block traffic when the forecast breaches the "Worst-Case" threshold.
