CyberSentinel

AI-powered security platform integrating Kali Linux tools with AI to detect and respond to credential attacks. *University project — received HD.

GitHub

Overview

CyberSentinel-AI combines traditional Kali Linux attack tooling with GPT-4o for real-time threat detection, analysis, and automated response. Focused on credential-based attacks (SSH brute force), it demonstrates how AI can meaningfully augment security operations.

Architecture

Hybrid bash/Python system running on Kali Linux:

• Bash scripts handle log monitoring and system-level actions (iptables)
• Python orchestrates AI analysis via GPT-4o API
• Structured JSON alerts flow between components

Core Components

Attack Detection

• Bash-based log monitoring (/var/log/auth.log)
• Brute force pattern recognition (failed SSH attempts, timing analysis)
• Real-time JSON alerts on threshold breaches

AI Analysis

• GPT-4o for threat intelligence and contextual analysis
• MITRE ATT&CK framework mapping (T1110 — Brute Force)
• Privacy impact assessment per incident

Automated Response

• IP blocking via iptables rules
• Severity-based escalation (low/medium/high/critical)
• Full audit logging of all automated actions

Attack Simulation

• Hydra-based SSH attacks for controlled testing
• Configurable parameters: target, wordlist, threads, timing

Features

• Sub-minute detection from first failed attempt to alert
• Structured JSON alerts for integration with SIEM/webhook consumers
• NIST compliance mapping built into analysis reports
• Complete audit trails of detection → analysis → response

Tech Stack

Outcome

Demonstrates AI-enhanced security operations with:

• Faster, more accurate detection vs. threshold-only approaches
• Richer analysis context via LLM threat intelligence
• Compliance-aware automated responses (NIST-aligned audit trails)