Raphael Okeke

Problem

Security teams drown in log volume long before they can act on it. Raw firewall and network events carry signal, but turning that signal into a Safe / Suspicious / Malicious call — fast enough to matter — means owning the full path from ingestion to inference to the analyst's screen.

Approach

1. 01Generated ~15,000 label-conditioned synthetic security logs so the model learns real attack signal — failed logins, unusual ports, packet size, VPN state — rather than noise.
2. 02Trained a scikit-learn pipeline (one-hot encoding + a 250-tree RandomForestClassifier) on an 80/20 stratified split, and shipped it behind a FastAPI service exposing /predict, /predict/batch, and /metrics.
3. 03Built the Node/Express API layer to persist every prediction to PostgreSQL via Prisma, enforce JWT auth with role-based access (Admin / Analyst / Viewer), and stream live-traffic scoring over SSE.
4. 04Shipped the Next.js dashboard: threat detection, live monitoring feed, ML performance charts (confusion matrix, ROC/AUC, feature importance), geo attack maps, alerting, and PDF/CSV reporting.

Result

A working full-stack + ML systems prototype: JWT/RBAC-secured API, a trained classifier serving real-time predictions, and a SOC-style interface — including a live command palette and a rule-based threat assistant — built on live backend data end to end.