SecuAI - AI-Powered Security Intelligence Platform

Transform raw security logs into actionable intelligence with Google Gemini AI

Comment

Inspiration

Traditional security monitoring tools tell you what happened - an IP tried to log in, a port was scanned, a request was made. But they leave the hard work to human analysts: Why does this matter? How dangerous is it? What should I do about it?

SecuAI was inspired by the challenge of alert fatigue in cybersecurity. Security teams receive thousands of alerts daily, and distinguishing real threats from noise is exhausting. We wanted to leverage Google's Gemini AI to bridge this gap - transforming raw logs into intelligent, actionable insights that anyone can understand.

What it does

SecuAI is an AI-powered security monitoring platform that combines traditional rule-based threat detection with Google Gemini 2.5 Flash AI to provide intelligent security analysis:

Core Features:

  • Real-time Log Analysis: Monitors SSH logs, web server logs, and Suricata IDS alerts
  • AI-Powered Threat Intelligence: Each alert is analyzed by Gemini AI to determine:
    • Attack severity (Critical/High/Medium/Low)
    • Risk score (1-100)
    • Attack type and techniques used
    • Step-by-step response recommendations
  • 24-Hour Dashboard: Real-time statistics showing alerts, critical threats, blocked IPs, and unique attackers
  • Smart Firewall Management: View and manage blocked/whitelisted IPs with AI-powered recommendations
  • Alert System: Comprehensive alert tracking with filtering by date range, severity, and AI analysis status
  • System Monitoring: CPU, memory, disk usage, load averages, process tracking, and system health metrics
  • Smart Analysis: Rate-limited AI calls with intelligent caching to maximize free tier usage
  • Web Interface: Responsive Bootstrap dashboard with real-time AI analysis and dark/light theme support
  • API Endpoints: RESTful API for integration with other security tools, SIEM systems, and automation

Attack Types Detected:

  • Brute force login attempts (SSH/FTP/web applications)
  • Port scanning and reconnaissance (Nmap, SYN floods)
  • Web application probing (admin panels, SQL injection, XSS attempts)
  • Directory traversal and file inclusion attacks
  • Suricata IDS alerts with signature matching
  • Suspicious command execution and privilege escalation attempts
  • Honeypot-detected malicious IPs

Security Response Features:

  • IP Blocking: Simulated blocking by default (safe for testing), real iptables integration available
  • Whitelist Management: Protect trusted IPs from automated blocking
  • Audit Logging: Complete activity tracking for compliance and forensics
  • Threat Simulator: Built-in attack generator for testing and demonstrations

How we built it

Technology Stack:

  • AI Engine: Google Gemini 2.5 Flash for threat analysis and risk assessment
  • Backend: Python 3.11 with Flask web framework
  • Database: SQLAlchemy ORM with SQLite (development) / PostgreSQL-ready (production)
  • Frontend: Bootstrap 5 with responsive design, jQuery for dynamic updates, Chart.js for visualizations
  • Deployment: Docker containerization + Google Cloud Run
  • Security: Rate limiting (60 req/min), 5-minute caching, Flask-Login authentication, password hashing

Architecture:

  1. Log Collection: Multiple sources (SSH auth.log, web server logs, Suricata EVE JSON, honeypot feeds, file uploads)
  2. Rule-Based Detection: Python analyzer with regex patterns for initial threat detection across multiple attack vectors
  3. AI Enhancement: Gemini API analyzes each alert to provide context, severity assessment, and actionable recommendations
  4. Smart Caching: Identical threats within 5 minutes use cached AI responses, reducing API costs by 60%
  5. Web Dashboard: Real-time display with staggered AI analysis loading, progressive enhancement, and duplicate prevention
  6. Firewall Integration: Simulated blocking (default) with optional iptables integration for production environments

Key Implementation Details:

  • Rate limiter with exponential backoff to handle Gemini API free tier limits (60 req/min)
  • Fallback analysis when AI is unavailable or rate-limited - system continues functioning
  • Docker multi-stage build optimized for Cloud Run with minimal image size
  • Environment variable configuration for Cloud Run compatibility (PORT, SECRET_KEY, GEMINI_API_KEY)
  • Gunicorn WSGI server with 1 worker and 8 threads for production workloads
  • Comprehensive test suite with pytest covering analyzer, web routes, and blocker functionality

Challenges we ran into

1. Gemini API Rate Limiting The free tier allows 60 requests per minute. With multiple alerts being generated from live attacks, we quickly hit limits and received 429 errors.

Solution: Implemented intelligent caching (5-min TTL) and rate limiting with exponential backoff. Duplicate threats within 5 minutes reuse cached AI analysis. Added request throttling that spaces out API calls. This reduced API calls by ~60% while maintaining real-time responsiveness.

2. Real-time AI Analysis Latency Each Gemini API call takes 1-2 seconds. Loading a dashboard with 50 alerts would block for 100 seconds, creating a terrible user experience.

Solution: Implemented staggered loading with visual feedback. Alerts load immediately with rule-based detection, then AI analysis populates progressively with loading spinners and smooth animations. Added duplicate prevention using JavaScript Sets to avoid analyzing the same alert multiple times during page interactions.

3. Model Availability and API Changes Initially tried "gemini-1.5-flash" which didn't exist in the API. Model names changed between API versions.

Solution: Implemented fallback logic trying multiple model names in order of preference ("gemini-2.5-flash", "gemini-2.0-flash", "gemini-pro-latest"). Added version checking and graceful degradation to rule-based analysis if all AI models fail. This ensures the system always works even if Google changes model names.

4. Cloud Run Deployment Complexity Cloud Run requires specific configurations (PORT env variable, stateless design, billing enabled, proper health checks).

Solution: Added PORT environment variable support with fallback to 5000 for local development. Optimized Dockerfile for Cloud Run with proper caching layers. Created automated deployment script (deploy.sh) that handles authentication, API enablement, and service configuration. Documented all requirements clearly.

5. Balancing Security and Usability Real IP blocking can accidentally lock out legitimate users or administrators if misconfigured.

Solution: Implemented simulation mode by default (safe for testing and demos). Real blocking requires explicit configuration flags and elevated privileges. Added comprehensive whitelisting, IP validation, and safety checks that prevent blocking local/private networks. Created detailed audit logs for all blocking actions.

Accomplishments that we're proud of

🎯 Production-Ready AI Integration: Not just a proof-of-concept - includes rate limiting, caching, retry logic with exponential backoff, error handling, and fallback analysis. The system gracefully handles API failures and continues functioning.

🚀 Intelligent Resource Management: Maximizes free tier usage through smart caching and request throttling while maintaining real-time responsiveness. Reduced API costs by 60% through intelligent caching strategies.

🧠 Meaningful AI Enhancement: Gemini doesn't just classify threats - it explains why they're dangerous, how attacks work, what the impact could be, and how to respond with step-by-step action plans in plain language that non-technical users can understand.

⚡ Fast & Responsive UI: Despite AI processing overhead, the UI remains snappy with progressive loading, visual feedback, staggered analysis, and smooth animations. Users see immediate results with enhanced insights appearing progressively.

🔒 Security-First Design: Simulation mode by default prevents accidents, authentication required for all admin actions, comprehensive audit logging for compliance, password hashing with Werkzeug, and multiple safety controls including IP whitelisting and private network protection.

📊 Complete Solution: Not just detection - includes dashboard with 24-hour statistics, firewall management interface, alert tracking with date filtering, system health monitoring, RESTful API, authentication system, Docker deployment, and comprehensive documentation.

🎥 Live Demo Ready: Built-in threat simulator generates realistic attacks for demonstrations. Includes sample data generation and automated attack scenarios that showcase AI analysis capabilities.

What we learned

About Gemini AI:

  • Gemini 2.5 Flash is incredibly fast for security analysis (<2 seconds per alert) compared to other LLMs
  • The model excels at understanding security context and providing actionable recommendations
  • Proper prompt engineering is crucial - structured JSON responses work better than free-form text
  • Including specific security context (IP, attack type, confidence) in prompts produces better analysis
  • Rate limiting is essential but manageable with smart caching strategies and request spacing
  • Fallback systems are critical - external APIs can fail and applications must continue working

About Cloud Run:

  • Serverless containers are perfect for security tools - auto-scaling handles traffic spikes during attacks
  • Environment variable configuration is critical for portability between local and cloud environments
  • Container optimization matters - multi-stage builds and layer caching reduce deployment time significantly
  • Billing must be enabled even for free tier usage (learned this during deployment!)
  • PORT environment variable must be configurable for Cloud Run compatibility
  • Gunicorn with proper worker/thread configuration essential for production workloads

About Security Monitoring:

  • AI can dramatically reduce security analyst workload by pre-analyzing threats and providing context
  • Explaining why something is dangerous is as important as detecting it - users need to understand risks
  • Real-time feedback is crucial - users need to see progress even when AI is processing in background
  • Fallback systems are essential - never fully rely on external APIs for critical security functions
  • Simulation mode is vital for safe testing without accidentally blocking legitimate traffic
  • Comprehensive logging and audit trails are necessary for incident response and compliance

About Software Engineering:

  • Progressive enhancement creates better UX - don't block users waiting for AI responses
  • Caching strategies can dramatically reduce external API costs and improve performance
  • Rate limiting and retry logic with exponential backoff prevent cascading failures
  • Proper error handling and graceful degradation keep systems running during failures
  • Docker multi-stage builds significantly reduce image size and deployment time
  • Comprehensive testing catches edge cases before production deployment

What's next for SecuAI - AI-Powered Security Intelligence Platform

Short-term Enhancements:

  • Integration with Google Secret Manager for secure API key management in production
  • PostgreSQL backend migration for production scalability and better concurrency
  • Cloud Armor integration for DDoS protection and advanced threat filtering
  • Mobile progressive web app (PWA) for security monitoring on-the-go with push notifications
  • Email/SMS alerting for critical threats using Cloud Functions
  • Enhanced visualization with D3.js for attack pattern analysis and geolocation mapping

Medium-term Goals:

  • Multi-Agent System: Use Google's Agent Development Kit (ADK) to create coordinated AI agents:
    • Detection Agent: Monitors logs and identifies threats in real-time
    • Analysis Agent: Uses Gemini to assess risk, intent, and attack vectors
    • Response Agent: Automatically applies firewall rules via Cloud Firewall API
    • Learning Agent: Improves detection accuracy based on false positive feedback
  • GPU-Accelerated ML: Deploy custom ML models on Cloud Run with NVIDIA L4 GPUs for:
    • Pattern recognition across historical attack data
    • Behavioral analysis of attackers and attack campaigns
    • Predictive threat modeling and anomaly detection
    • Real-time traffic classification at scale

Long-term Vision (Enterprise Features):

  • Multi-tenant architecture for Managed Security Service Providers (MSPs)
  • SIEM integration with Splunk, ELK Stack, QRadar, and other enterprise platforms
  • Compliance reporting for SOC 2, ISO 27001, GDPR, and industry standards
  • Automated incident response workflows with playbook execution
  • Threat intelligence feed integration (MISP, STIX/TAXII, commercial feeds)
  • Advanced analytics with machine learning for zero-day detection
  • Kubernetes deployment option for on-premise enterprise installations
  • Role-based access control (RBAC) with SSO/SAML integration
  • Custom detection rules and alert tuning via web interface

Built With

Share this project:

Updates

Submission history