SixGuard

About the Project

Inspiration: Traditional security systems rely heavily on predefined rules and signatures, which often struggle against evolving attack patterns. We wanted to explore whether Large Language Models (LLMs) could understand the intent behind suspicious payloads and provide intelligent, context-aware threat detection in real time. This idea inspired us to build SixGuard.

What We Built: SixGuard is an enterprise-grade, event-driven security monitoring platform that uses AI to analyse incoming requests and identify malicious activity. It acts as a middleware layer between clients and backend services, enabling real-time threat detection and automated defensive actions. The platform includes a FastAPI-based dashboard, Redis-backed worker queues, and Groq-powered Llama 3.3 for semantic threat analysis.

How We Built It: We used Python and FastAPI to develop the API gateway and monitoring dashboard. Redis was integrated as both a message broker and blocklist store, allowing asynchronous processing through worker queues. Threat analysis was powered by Groq's Llama 3.3, enabling contextual understanding of payloads. We also implemented structured logging and GitHub Actions for CI workflows to ensure maintainability and reliability.

Challenges We Faced: One of the biggest challenges was balancing the intelligence of LLM-based analysis with system performance. Running AI analysis directly in the request path introduced latency, so we redesigned the system using asynchronous workers to keep the application responsive. Another challenge was prompt engineering, tuning the AI to minimise false positives while accurately identifying genuine threats. Building transparent logging and observability mechanisms also required significant effort.

What We Learned: Through SixGuard, we learned how to integrate LLMs into production-orientated systems, design scalable event-driven architectures, and think critically about security trade-offs. More importantly, we realised that successful AI-powered security solutions require not only advanced models but also robust engineering practices that prioritise scalability, reliability, and trust.

Future Improvements: We plan to add multi-model threat consensus, adaptive rate limiting based on threat scores, deeper SIEM integrations, threat intelligence enrichment, and Kubernetes-based autoscaling to further enhance SixGuard's capabilities.