Skip to content

PROJECT_PROPOSAL.md

Latest commit

 

History

History
84 lines (71 loc) · 3.68 KB

PROJECT_PROPOSAL.md

File metadata and controls

84 lines (71 loc) · 3.68 KB
Raw

SentinelX Project Proposal

1. Project Title

SentinelX: Intelligent AI DevOps & Network Defense Platform

2. Executive Summary

SentinelX is a cybersecurity platform that combines real-time network monitoring, AI-based intrusion detection, distributed processing, API services, dashboard visualization, and a domain-specific query language (DSL). The project will deliver an integrated, production-oriented system that captures packet traffic, detects threats, and presents actionable insights through APIs and a monitoring dashboard.

3. Problem Statement

Network infrastructures generate high-volume traffic, and manual or rule-only monitoring cannot reliably detect modern attacks in time. Organizations need a system that can:

  • monitor traffic continuously,
  • detect suspicious behavior with AI,
  • expose results through reliable services,
  • and support quick analytical queries for operators.

4. Project Objectives

  1. Build a live packet-capture and feature-extraction pipeline.
  2. Integrate ML-based intrusion/anomaly detection.
  3. Provide robust backend APIs for health, prediction, and analytics.
  4. Develop a user-friendly monitoring dashboard.
  5. Implement a mini DSL for threat/traffic queries.
  6. Enable deployable architecture with container/cloud readiness.
  7. Maintain software quality through structured documentation and validation.

5. Scope

In Scope

  • Real-time and batch-oriented network traffic analysis.
  • ML inference for attack classification.
  • API layer for prediction and reporting.
  • Persistent storage for traffic/prediction records.
  • Dashboard visualizations and operational monitoring.
  • DSL query execution over stored and live data.

Out of Scope

  • Full SIEM replacement and enterprise SOC orchestration.
  • Fully autonomous mitigation actions in production.
  • Unlimited scale guarantees without infrastructure tuning.

6. Proposed Architecture (High-Level)

  1. Packet Sniffer Module (traffic collection)
  2. Feature Aggregation Layer (model-ready features)
  3. ML Detection + Validation Layer (classification + confidence gating)
  4. Database Layer (predictions, stats, audit-friendly records)
  5. FastAPI Service Layer (REST endpoints)
  6. Frontend Dashboard (Streamlit/React)
  7. DSL Query Layer (human-friendly security queries)
  8. Deployment Layer (Docker/AWS-oriented runtime)

7. Stakeholders

  • Security Analysts / SOC Operators
  • DevOps and Platform Engineers
  • Network Administrators
  • Academic and research contributors

8. Technology Stack

  • Language: Python
  • Backend: FastAPI
  • Frontend: Streamlit / React
  • ML: scikit-learn, XGBoost, NumPy, Pandas
  • Network Capture: Scapy
  • Database: SQLite/PostgreSQL via SQLAlchemy + Alembic
  • Deployment: Docker, cloud-ready workflows

9. Deliverables

  1. Running backend API with documented endpoints.
  2. Monitoring dashboard with threat and traffic views.
  3. Integrated ML model artifacts for inference.
  4. DSL parser/executor for security queries.
  5. Database migration support and operational scripts.
  6. Complete proposal + SRS documentation set.

10. Risks and Mitigation

  • Permission limits for packet capture: provide fallback behavior and setup guidance.
  • Model performance variance: calibrate thresholds and retrain periodically.
  • High traffic load: optimize processing and support distributed workflows.
  • Deployment inconsistencies: use containerized environments and migration controls.

11. Success Criteria

  • End-to-end stack runs with documented setup.
  • Traffic ingestion and predictions operate reliably.
  • API and dashboard provide consistent operational visibility.
  • DSL queries return correct, timely results.
  • Documentation is complete enough for onboarding and maintenance.