Vivian

Admin UI - shows the live map of the connections
Logs of the connections

Inspiration

Almost everything we use now runs in the cloud, which also makes it exposed to the whole internet. Traditional firewalls rely on fixed rules that attackers learn to get around, and small teams rarely have a security analyst watching traffic. We wanted a shield that sits in front of any cloud app and learns what an attack looks like.

What it does

Vivian is a reverse proxy that protects a cloud app. Every request is scored by a machine learning classifier, and malicious ones are blocked before they reach the app. Legitimate users pass straight through. A live dashboard shows where traffic comes from on a world map, and an AI security analyst explains in plain language why a request was blocked. A built-in Traffic Lab lets you simulate normal and attack traffic to see it work.

How we built it

Proxy: a Go reverse proxy that classifies each request. It embeds the request with EmbeddingGemma through Ollama and scores it with a trained classifier.
Data: request telemetry is stored in MongoDB.
Dashboard: a Next.js and React app with a D3 world map, GeoIP lookups and Tailwind styling.
AI analyst: Grok acts as a SOC analyst that triages traffic and explains decisions.
Deployment: Docker Compose runs the whole stack with one command.

Challenges we ran into

Training data bias: our model was trained on 2020 traffic data and used the year as a feature, so its weights were unusable outside of 2020. We tried removing the time feature and normalizing timestamps, but the model still behaved poorly on requests from other periods. In the end we retrained it on data with the timestamp removed.
Realistic test traffic: we needed attack-shaped traffic to test against, which is why we built the Traffic Lab.

Accomplishments that we're proud of

A working end-to-end system: traffic comes in, is classified, blocked or allowed, and shows up live on the dashboard.
A drop-in design that protects an app with no changes to its code.
A dashboard and AI analyst that make security decisions understandable to non-experts.
A Traffic Lab that lets anyone see the system work in seconds.

What we learned

Embeddings are a flexible way to represent network requests, and a small classifier on top can go a long way.
A model can learn shortcuts, like the year, that look fine in training and fail in the real world. Patching the feature afterward wasn't enough, so we had to fix the data and retrain.
Security tooling is only useful if people can understand its decisions.
Shipping a multi-service system quickly takes clear boundaries between components.