--- title: CyberShield AI emoji: 🛡️ colorFrom: blue colorTo: indigo sdk: gradio sdk_version: 6.22.0 app_file: gradio_app.py python_version: "3.11" fullWidth: true pinned: false --- CyberShield AI AI Cyber Threat Intelligence Dashboard CyberShield AI is an end-to-end cybersecurity dashboard built with Gradio. It combines machine-learning intrusion detection, Gemini-powered threat explanations, local RAG-based cybersecurity assistance, screenshot analysis, live vulnerability intelligence, and MCP tools in one application. Project Overview Modern networks generate a large amount of traffic every day. Manually checking every record is difficult, slow, and error-prone. CyberShield AI solves this problem by using a trained machine-learning model to classify network traffic and present the result in a simple dashboard. The system was developed as an internship major project using the CICIDS2017 network intrusion detection dataset. Main Features Gradio-based cybersecurity dashboard Machine-learning network attack classification CSV-based bulk threat prediction Prediction confidence and attack distribution charts Gemini-based threat explanation Local RAG cybersecurity assistant using MiniLM and ChromaDB Suspicious screenshot and phishing-image analysis CISA Known Exploited Vulnerabilities feed NVD CVE search VirusTotal URL analysis MCP server with reusable cybersecurity tools System Check page for models, APIs, datasets, and backend services Downloadable prediction results Machine-Learning Results Model Accuracy Precision Recall F1 Score Training Time Random Forest 99.80% 99.80% 99.80% 99.79% 22.08 s XGBoost 99.30% 99.30% 99.30% 99.30% 29.99 s Logistic Regression 91.51% 88.59% 91.51% 89.89% 259.83 s LightGBM 88.64% 88.01% 88.64% 88.11% 14.46 s Random Forest was selected as the final deployment model because it achieved the best overall accuracy, precision, recall, and F1 score. The CICIDS2017 dataset is highly imbalanced. Accuracy should be interpreted together with precision, recall, F1 score, confusion matrix, and class-level results. Dataset and Preprocessing Dataset: CICIDS2017 Original records: 2,827,876 Duplicate records removed: 307,078 Final clean records: 2,520,798 Input features: 78 Target column: Label Preprocessing steps: Cleaned column names Replaced infinite values Handled missing values Removed duplicate records Encoded attack labels Performed stratified train-test split Saved the final model and label encoder The large raw and processed datasets are not included in this repository because of GitHub file-size limits. Technology Stack Frontend Gradio Plotly Pandas Pillow Machine Learning Scikit-learn Random Forest XGBoost LightGBM Joblib Generative AI and RAG Google Gemini Sentence Transformers MiniLM embeddings ChromaDB Threat Intelligence CISA KEV NVD CVE API VirusTotal API Integration FastAPI Model Context Protocol Streamable HTTP Requests Project Structure CyberShield-AI/ │ ├── gradio_app.py ├── app.py # Streamlit backup version, optional ├── requirements.txt ├── README.md ├── .gitignore │ ├── ai/ │ ├── gemini_analyzer.py │ ├── gemini_utils.py │ └── image_analyzer.py │ ├── services/ │ └── prediction_service.py │ ├── rag/ │ ├── build_vector_store.py │ ├── rag_assistant.py │ └── semantic_search.py │ ├── embeddings/ │ └── local_embeddings.py │ ├── mcp_servers/ │ └── cybershield_server.py │ ├── saved_models/ │ ├── best_model.pkl │ └── label_encoder.pkl │ ├── data/ │ ├── knowledge_base/ │ │ └── cyber_knowledge.json │ └── chroma_db/ │ ├── reports/ │ └── model_results.csv │ ├── test_images/ └── utils/ Some filenames may differ slightly depending on the local project version. Installation 1. Clone the repository git clone https://github.com/YOUR_USERNAME/CyberShield-AI.git cd CyberShield-AI Replace YOUR_USERNAME with your GitHub username. 2. Create and activate a virtual environment Windows: python -m venv venv venv\Scriptsctivate Linux or macOS: python3 -m venv venv source venv/bin/activate 3. Install dependencies pip install -r requirements.txt Environment Variables Create a .env file in the project root: GEMINI_API_KEY=your_gemini_api_key NVD_API_KEY=your_nvd_api_key VIRUSTOTAL_API_KEY=your_virustotal_api_key Do not upload .env or API keys to GitHub. For deployment, add these values using the platform secrets/environment-variable settings. Run the Gradio Dashboard python gradio_app.py The application usually opens at: http://127.0.0.1:7860 Run the MCP Server Open a second terminal, activate the virtual environment, and run: python -m mcp_servers.cybershield_server The MCP server exposes tools such as: explain_threat search_cyber_knowledge summarize_security_report Dashboard Tabs Home — Project overview, KPIs, model performance, and charts System Check — Model, encoder, API, dataset, RAG, and service status Threat Prediction — Upload a 78-feature CSV and classify network traffic AI Assistant — Ask cybersecurity questions using local RAG and Gemini Image Analyzer — Analyse screenshots for phishing and security risks Live Threat Intelligence — View CISA, NVD, and VirusTotal information MCP Status — Check MCP server and tool availability Testing Status The following modules were tested successfully locally: Gradio interface loading System Check Model and label encoder loading Threat prediction CSV template and upload Prediction confidence Result download Gemini explanations Local RAG assistant Image analysis CISA KEV loading NVD CVE search VirusTotal URL checking MCP server and status Deployment The Gradio version can be deployed using Hugging Face Spaces. Recommended deployment settings: SDK: Gradio Entry file: gradio_app.py Python dependencies: requirements.txt Secrets: GEMINI_API_KEY NVD_API_KEY VIRUSTOTAL_API_KEY Deployment workflow: Push the cleaned project to GitHub Create a new Hugging Face Space Select Gradio as the SDK Upload or connect the repository files Add API keys as secrets Deploy and test the public URL The MCP server can remain local for an academic demonstration or can be deployed separately on a Python web-service platform. Files Not Included in GitHub The following files should not be pushed: .env venv/ __pycache__/ catboost_info/ app_backup.py app_old_backup.py app_before_quota_update.py data/raw/ data/processed/cyber_dataset_clean.csv data/chroma_db_gemini_backup/ saved_models/X_train.pkl saved_models/X_test.pkl saved_models/y_train.pkl saved_models/y_test.pkl saved_models/label_encoder_corrupted.pkl Limitations The model is trained on CICIDS2017 and may not represent every modern attack pattern Class imbalance affects rare attack categories Gemini output depends on API availability and quota Image analysis requires an external AI service Gradio is suitable for academic prototypes, but a production SOC platform would need stronger authentication, logging, and monitoring The MCP server may require separate deployment for public access Future Scope Test with newer intrusion-detection datasets Add real-time packet or Kafka event streaming Add SHAP explanations Tune class weights and prediction thresholds Add authentication and role-based access Add audit logging and cloud monitoring Expose prediction through FastAPI Deploy the MCP server publicly Author Nikhil Kishor PatilDiploma in Computer EngineeringInternship ID: 2621 Disclaimer This project is intended for educational and defensive cybersecurity purposes only.