WalSec A-TIOC Hub
A privacy-first SIEM-Lite that fuses network forensics with local LLMs
Context
WalSec A-TIOC Hub was my BSc final-year development project (CTEC3451D). It is a fully self-hosted “SIEM-Lite” that bridges automated network forensics with locally-hosted Large Language Models, so a resource-constrained Security Operations Centre can triage threats with AI that never leaves its own perimeter.
The problem
Modern SOCs drown in noise — an estimated 67% of security alerts are ignored due to volume and cognitive overload. Enterprise SIEMs are prohibitively expensive for SMEs, and pushing sensitive telemetry to cloud AI (e.g. OpenAI) creates serious GDPR and data-sovereignty exposure. The challenge: deliver grounded, automated threat analysis entirely on-premise.
My approach
I built a decoupled architecture: a cyberpunk-styled React 18 + Vite SPA over a Flask 3.0 API on Eventlet, offloading CPU-heavy PyShark dissection to Python multiprocessing pools. A RAG pipeline (BGE-M3 multi-vector embeddings + Ollama-hosted Llama 3.2 / Qwen2.5) grounds every inference in evidence pulled from a WAL-optimised SQLite store, so the model correlates findings to MITRE ATT&CK instead of hallucinating them.
Decoupled, fully-local pipeline
Automated forensic ingestion
The system eliminates manual TShark triage. Asynchronous Deep Packet Inspection parses uploaded PCAPs (hard-capped at 50MB via byte-pointer logic to protect the event loop), while APScheduler workers pull fresh OSINT from ThreatFox and URLhaus every 30–60 minutes.
- Normalisation pipeline strips port metadata for uniform IP vectors
- Database-level deduplication via composite (Type + Value) keys
- Controlled, scheduled enrichment from Abuse.ch and ip-api.com
Grounded AI, not generative guesswork
Unbounded LLMs hallucinate threat intel in a vacuum. I subjected the system to “Evidentiary Vacuum” testing — querying non-existent IPs and domains — and achieved a 100% hallucination-prevention rate. Strict prompt boundaries force SQL joins to override model generation; with no local evidence the model returns “Insufficient local evidence” rather than fabricating.
Dynamic threat scoring
A 100-point scalar function ranks indicators so analysts hit the most critical threats first, combining base confidence, a recency modifier, a malware-family boost and tag-severity weighting.
Engineered for robustness
Cooperative multitasking under Eventlet initially caused cron jobs to miss triggers by up to 14 minutes under heavy PyShark load; I solved it by isolating the dissection engine into detached multiprocessing pools. Comprehensive try/except wrappers keep core threading stable through catastrophic external-API outages, and byte-pointer logic (file.seek) physically halts memory buffering beyond 50MB.
Outcome
Delivered a viable, zero-configuration SIEM-Lite for resource-constrained environments with 100% local execution — bridging raw TShark packet inspection and strategic, C-level MITRE reporting via generative AI. Roadmap: Redis-backed rate limiting, agentic RAG (AI-instructed historical PCAP re-scans), and Kubernetes scaling for concurrent inference.