~/sabarish.dev
← all posts

~/posts/ai-threat-detection-security-operations

AI Threat Detection & Security Operations: emails, URLs, QR codes & logs in one SOC platform

Sabarish R3 min read
  • security
  • soc
  • ai-ml
  • python

This was my first of two individual projects for Round 2 of the Shentinelix Sphere internship (following the Round 1 training labs). The brief: one real-time, innovative project addressing a current cybersecurity problem, with depth and research quality — and an audience of the international security community at the end of it.

I chose the problem I kept bumping into during Round 1: security tools that operate in silos.

The problem

Phishing emails, malicious URLs, QR-based attacks (QRishing), and suspicious log activity are usually caught by different tools that don't talk to each other. The result is contextual blindness and a flood of false positives. A URL might look clean to one vendor while the email carrying it is flagged by another — and nobody is correlating the two.

The idea behind this project: one platform that analyzes emails, URLs, QR codes, and logs, fusing rule-based detection with AI reasoning and multiple threat-intelligence feeds.

The architecture

A modular, service-oriented pipeline:

  • Input sources — URLs, emails, QR images, security logs
  • Processing layer — validation, parsing, normalization
  • Threat intelligence layer — VirusTotal, Google Safe Browsing, PhishTank, AbuseIPDB, RDAP
  • AI analysis layer — an LLM API for contextual reasoning
  • Scoring engine — risk and severity calculation
  • Storage — SQLite
  • Presentation — web dashboard with real-time updates

A Chrome extension (Manifest V3) extends the same checks to the browser, so threat protection follows you outside the dashboard.

Detection techniques

  • NLP-based phishing classification for email content
  • AI fusion scoring — the LLM provides contextual reasoning on top of the hard threat-intel signals
  • Rule-based SOC patterns for log analysis
  • Severity scoring based on confidence and threat indicators

For each input type, the pipeline does something specific:

  • URLs — unified intelligence pipeline against VirusTotal, Safe Browsing, PhishTank, and AbuseIPDB, with caching so repeat lookups are instant
  • Emails — fetched via the Gmail API and scanned for phishing indicators
  • QR codes — decoded and validated against the threat-intel sources (QRishing detection)
  • Logs — rule-based detection plus AI-assisted reasoning for anomalies

Every event is logged and visualized on a real-time dashboard.

Tech stack

Python 3.11 · Flask · SQLAlchemy · SQLite · LLM API · VirusTotal · Google Safe Browsing · PhishTank · AbuseIPDB · Flask-SocketIO · Bootstrap · Chart.js · Chrome Extension (MV3) · Pytest · GitHub Actions

Security engineering in the project itself

  • API keys managed via environment variables — nothing in code or frontend
  • Parameterized database queries to prevent SQL injection
  • Rate limiting on the external APIs
  • Server-side enforcement of security rules

Testing & results

  • Unit, integration, and end-to-end tests
  • External API calls mocked during testing — CI runs on every commit
  • Pytest coverage reports

Use cases

  • SOC monitoring and triage
  • Email security gateway
  • Browser-level threat protection
  • Incident response and threat investigation

The original platform repo is now private: its SOC/log-analysis engine was extracted into a standalone service, and the email side lives on in mailforensic-ai.

Planned next steps from the documentation: SIEM integration, ML-based anomaly detection for logs, multi-tenant support, and cloud-native deployment.