WalSec A-TIOC Hub
A privacy-first SIEM-Lite that fuses network forensics with local LLMs
Problem
Analysts face more alerts than they can read, most of them noise. Enterprise SIEMs cost more than small organisations can pay, and sending packet captures to a cloud AI service (OpenAI, for example) can expose personal data and break GDPR and data-sovereignty rules. The challenge: grounded, automated threat analysis that runs entirely on-premise.
WalSec A-TIOC Hub was my BSc final-year development project (CTEC3451D). It was faculty-commended and formally recommended for publication. It is a self-hosted “SIEM-Lite” that joins automated network forensics to locally hosted language models, so a small Security Operations Centre can triage threats with AI that never leaves its own perimeter.
What I did
I built a decoupled architecture: a React 18 + Vite single-page app over a Flask 3.0 API on Eventlet, with CPU-heavy PyShark dissection moved into Python multiprocessing pools. A RAG pipeline (BGE-M3 embeddings, local Qwen and DeepSeek models served by Ollama) grounds every answer in evidence from a SQLite store in WAL mode, and the AI analyst maps that evidence to MITRE ATT&CK techniques through prompts backed by technique and mapping tables in the same database.
Automated forensic ingestion
The system replaces manual TShark triage. Asynchronous deep packet inspection parses uploaded PCAPs (their size is checked with file.seek against a cap before parsing, to protect the event loop), while APScheduler workers pull fresh indicators from ThreatFox and URLhaus on a schedule. The local store held over 9,000 ThreatFox IOCs in October 2026.
- Normalisation pipeline strips port metadata for uniform IP vectors
- Database-level deduplication via composite (Type + Value) keys
- Scheduled pulls from the abuse.ch ThreatFox and URLhaus APIs
Grounded AI, not generative guesswork
A language model with no evidence will invent threat intelligence. Strict prompt boundaries make the answer depend on what the SQL lookups return: with no local evidence, the model replies “Insufficient local evidence” (or “Not Found”) instead of making something up. The test matrix records this case: TC-AI-02 asked about a domain that doesn't exist, and the model refused to extrapolate. That is one recorded test, not a measured rate.
Dynamic threat scoring
Each indicator gets a score so analysts see the most critical first: a base score plus boosts for recency, a known malware family and its tags. The recency boost is largest for a fresh indicator and shrinks as it ages.
Engineered for robustness
Under Eventlet's cooperative multitasking, heavy PyShark work blocked the scheduler: APScheduler logged the ThreatFox ingestion job missing its scheduled slot. I moved the dissection engine into separate multiprocessing pools so the event loop keeps running. Exception handling keeps ingestion alive when an external feed is unreachable (the logs record a URLhaus outage that the app survived).
Evidence
The platform is private; a live demo is available on request.
- IOCs ingested
- 9,000+
- from the ThreatFox API · stored count, Oct 2026
- Faculty review
- Commended
- final-year project, formally recommended for publication
- Out-of-evidence query
- Refused
- test TC-AI-02: non-existent domain → “Not Found”
- AI inference
- Offline
- Qwen · DeepSeek via Ollama, no cloud API
- In
- OSINT feedsThreatFox · URLhaus
- PCAP uploaddeep packet inspection
- Core
- Flask 3.0 APIEventlet + multiprocessing
- SQLite (WAL)ACID evidence store
- Local AI
- RAG · BGE-M3Qwen · DeepSeek (Ollama)
- Out
- React SPAWebSocket telemetry
Stack and tools
Result
A working SIEM-Lite for small, resource-constrained teams that runs entirely on local hardware, from raw TShark packet inspection to ATT&CK-mapped reports written by a local model. Faculty-commended and recommended for publication. Roadmap: Redis-backed rate limiting, agentic RAG (AI-instructed re-scans of historical PCAPs) and scaling inference across more hardware.
Limitations
The out-of-evidence behaviour is shown by one recorded test, not a measured rate. No latency figure is given: the hardware wasn’t recorded, and the models have changed since testing. Setup is not zero-configuration: it needs a Linux host with Docker and Ollama, the models pulled in advance, and dependencies installed offline.