Smart Security Log Analysis using LLM (CyberLog Sentinel)

CyberLog Sentinel" is an advanced cybersecurity tool powered by Natural Language Processing (NLP) and Large Language Models (LLMs). The system is designed to intelligently analyze server logs, firewall logs, and application logs to detect suspicious activities and cyber threats, such as SQL Injections and Brute Force attacks.

Key Features & Contributions:

Specialized Threat Analysis Engine: The AI is strictly governed by Constitutional AI rules, ensuring it functions exclusively as a cybersecurity expert and avoids out-of-scope interactions.

Intelligent Log Cleansing: Implemented an advanced preprocessing mechanism to filter large log files, extracting only relevant lines containing suspicious keywords (e.g., error, failed, 403, sql), significantly reducing noise and improving LLM accuracy.

Context & Memory Management: Built a robust, database-backed memory system that maintains chat history. This ensures the AI understands the full context of ongoing threat investigations.

Advanced Prompt Engineering: Developed layered system prompts featuring specific cybersecurity personas (e.g., Strict CISO) and utilized Chain of Thought reasoning for deep, professional analysis.

Tactical Remediation Engine: Engineered a specialized AI module dedicated to generating step-by-step mitigation plans, covering immediate actions, deep investigation steps, and long-term hardening.

Full RESTful API (Django DRF): Developed a comprehensive backend architecture using Django REST Framework. It provides endpoints for seamless log uploading, threat analysis, and chat session management.

Security & Cost Controls: Integrated a Token Pricing System (using tiktoken) to calculate virtual costs per analysis, alongside a robust API Rate Limiting mechanism to prevent abuse (verified via multi-threaded stress-testing scripts).

Tracing & Observability: Integrated with LangSmith for background pipeline tracing, allowing deep visibility into prompt formatting, LLM outputs, and system debugging.

This project was built to be scalable, secure, and highly valuable for Security Operations Center (SOC) and Incident Response teams.