README.md

metadata

title: CyberShield AI
emoji: 🛡️
colorFrom: blue
colorTo: indigo
sdk: gradio
sdk_version: 6.22.0
app_file: gradio_app.py
python_version: '3.11'
fullWidth: true
pinned: false

CyberShield AI

AI Cyber Threat Intelligence Dashboard

CyberShield AI is an end-to-end cybersecurity dashboard built with Gradio. It combines machine-learning intrusion detection, Gemini-powered threat explanations, local RAG-based cybersecurity assistance, screenshot analysis, live vulnerability intelligence, and MCP tools in one application.

Project Overview

Modern networks generate a large amount of traffic every day. Manually checking every record is difficult, slow, and error-prone. CyberShield AI solves this problem by using a trained machine-learning model to classify network traffic and present the result in a simple dashboard.

The system was developed as an internship major project using the CICIDS2017 network intrusion detection dataset.

Main Features

Gradio-based cybersecurity dashboard

Machine-learning network attack classification

CSV-based bulk threat prediction

Prediction confidence and attack distribution charts

Gemini-based threat explanation

Local RAG cybersecurity assistant using MiniLM and ChromaDB

Suspicious screenshot and phishing-image analysis

CISA Known Exploited Vulnerabilities feed

NVD CVE search

VirusTotal URL analysis

MCP server with reusable cybersecurity tools

System Check page for models, APIs, datasets, and backend services

Downloadable prediction results

Machine-Learning Results

Model

Accuracy

Precision

Recall

F1 Score

Training Time

Random Forest

99.80%

99.80%

99.80%

99.79%

22.08 s

XGBoost

99.30%

99.30%

99.30%

99.30%

29.99 s

Logistic Regression

91.51%

88.59%

91.51%

89.89%

259.83 s

LightGBM

88.64%

88.01%

88.64%

88.11%

14.46 s

Random Forest was selected as the final deployment model because it achieved the best overall accuracy, precision, recall, and F1 score.

The CICIDS2017 dataset is highly imbalanced. Accuracy should be interpreted together with precision, recall, F1 score, confusion matrix, and class-level results.

Dataset and Preprocessing

Dataset: CICIDS2017

Original records: 2,827,876

Duplicate records removed: 307,078

Final clean records: 2,520,798

Input features: 78

Target column: Label

Preprocessing steps:

Cleaned column names

Replaced infinite values

Handled missing values

Removed duplicate records

Encoded attack labels

Performed stratified train-test split

Saved the final model and label encoder

The large raw and processed datasets are not included in this repository because of GitHub file-size limits.

Technology Stack

Frontend

Gradio

Plotly

Pandas

Pillow

Machine Learning

Scikit-learn

Random Forest

XGBoost

LightGBM

Joblib

Generative AI and RAG

Google Gemini

Sentence Transformers

MiniLM embeddings

ChromaDB

Threat Intelligence

CISA KEV

NVD CVE API

VirusTotal API

Integration

FastAPI

Model Context Protocol

Streamable HTTP

Requests

Project Structure

CyberShield-AI/ │ ├── gradio_app.py ├── app.py # Streamlit backup version, optional ├── requirements.txt ├── README.md ├── .gitignore │ ├── ai/ │ ├── gemini_analyzer.py │ ├── gemini_utils.py │ └── image_analyzer.py │ ├── services/ │ └── prediction_service.py │ ├── rag/ │ ├── build_vector_store.py │ ├── rag_assistant.py │ └── semantic_search.py │ ├── embeddings/ │ └── local_embeddings.py │ ├── mcp_servers/ │ └── cybershield_server.py │ ├── saved_models/ │ ├── best_model.pkl │ └── label_encoder.pkl │ ├── data/ │ ├── knowledge_base/ │ │ └── cyber_knowledge.json │ └── chroma_db/ │ ├── reports/ │ └── model_results.csv │ ├── test_images/ └── utils/

Some filenames may differ slightly depending on the local project version.

Installation

1. Clone the repository

git clone https://github.com/YOUR_USERNAME/CyberShield-AI.git cd CyberShield-AI

Replace YOUR_USERNAME with your GitHub username.

2. Create and activate a virtual environment

Windows:

python -m venv venv venv\Scriptsctivate

Linux or macOS:

python3 -m venv venv source venv/bin/activate

3. Install dependencies

pip install -r requirements.txt

Environment Variables

Create a .env file in the project root:

GEMINI_API_KEY=your_gemini_api_key NVD_API_KEY=your_nvd_api_key VIRUSTOTAL_API_KEY=your_virustotal_api_key

Do not upload .env or API keys to GitHub.

For deployment, add these values using the platform secrets/environment-variable settings.

Run the Gradio Dashboard

python gradio_app.py

The application usually opens at:

http://127.0.0.1:7860

Run the MCP Server

Open a second terminal, activate the virtual environment, and run:

python -m mcp_servers.cybershield_server

The MCP server exposes tools such as:

explain_threat

search_cyber_knowledge

summarize_security_report

Dashboard Tabs

Home — Project overview, KPIs, model performance, and charts

System Check — Model, encoder, API, dataset, RAG, and service status

Threat Prediction — Upload a 78-feature CSV and classify network traffic

AI Assistant — Ask cybersecurity questions using local RAG and Gemini

Image Analyzer — Analyse screenshots for phishing and security risks

Live Threat Intelligence — View CISA, NVD, and VirusTotal information

MCP Status — Check MCP server and tool availability

Testing Status

The following modules were tested successfully locally:

Gradio interface loading

System Check

Model and label encoder loading

Threat prediction

CSV template and upload

Prediction confidence

Result download

Gemini explanations

Local RAG assistant

Image analysis

CISA KEV loading

NVD CVE search

VirusTotal URL checking

MCP server and status

Deployment

The Gradio version can be deployed using Hugging Face Spaces.

Recommended deployment settings:

SDK: Gradio

Entry file: gradio_app.py

Python dependencies: requirements.txt

Secrets:

GEMINI_API_KEY

NVD_API_KEY

VIRUSTOTAL_API_KEY

Deployment workflow:

Push the cleaned project to GitHub

Create a new Hugging Face Space

Select Gradio as the SDK

Upload or connect the repository files

Add API keys as secrets

Deploy and test the public URL

The MCP server can remain local for an academic demonstration or can be deployed separately on a Python web-service platform.

Files Not Included in GitHub

The following files should not be pushed:

.env venv/ pycache/ catboost_info/ app_backup.py app_old_backup.py app_before_quota_update.py data/raw/ data/processed/cyber_dataset_clean.csv data/chroma_db_gemini_backup/ saved_models/X_train.pkl saved_models/X_test.pkl saved_models/y_train.pkl saved_models/y_test.pkl saved_models/label_encoder_corrupted.pkl

Limitations

The model is trained on CICIDS2017 and may not represent every modern attack pattern

Class imbalance affects rare attack categories

Gemini output depends on API availability and quota

Image analysis requires an external AI service

Gradio is suitable for academic prototypes, but a production SOC platform would need stronger authentication, logging, and monitoring

The MCP server may require separate deployment for public access

Future Scope

Test with newer intrusion-detection datasets

Add real-time packet or Kafka event streaming

Add SHAP explanations

Tune class weights and prediction thresholds

Add authentication and role-based access

Add audit logging and cloud monitoring

Expose prediction through FastAPI

Deploy the MCP server publicly

Author

Nikhil Kishor PatilDiploma in Computer EngineeringInternship ID: 2621

Disclaimer

This project is intended for educational and defensive cybersecurity purposes only.