forlives/cloudsight-ai

CloudSight AI is a security platform designed to detect threats in network traffic from IoT devices, which are the small connected gadgets like smart cameras, routers, and sensors that make up the "Internet of Things." A distinctive challenge with IoT traffic is that much of it is encrypted, so the platform must identify suspicious patterns without reading the content of the packets. When you upload a network capture file (a recording of raw network traffic), the platform parses it into numerical features and builds a graph showing how devices communicated. It then routes this data to one of two detection engines. The fast engine gives a verdict in under a second using a lightweight model suited to small, simple traffic samples. The deep engine takes more time and uses a combination of a graph neural network and a transformer model to analyze complex or large samples, producing a detailed report with an explanation of its findings. Users can let the platform choose automatically or override and pick an engine themselves. The output includes a verdict (clean, suspicious, or malicious), a threat radar chart, a mapping to the MITRE ATT&CK framework (a standard catalog of attack techniques), and a network forensics summary. The platform can recognize eleven categories of threat including DDoS attacks, botnet activity (Mirai, Okiru, Torii), and command-and-control traffic. It also supports an optional connection to an external AI language model API to generate a plain-language explanation of the threat. At the time of writing, this repository contains a live interactive demo and documentation only. The full source code, model weights, and training code are reserved for release after the related academic papers are published. The demo runs on built-in example data directly in the browser.