AI & Machine Learning

Sentinells: Proactive Log Detection via LLMs

4th Year Academic Project | Strathmore University | November 2025

Python / Flask Llama 3.2:3B Ollama Unsloth SQLite

Executive Summary

The Challenge: Security Operations Center (SOC) analysts face overwhelming "alert fatigue." Traditional Security Information and Event Management (SIEM) tools rely on static, rigid rules to parse millions of logs. This approach generates excessive false positives and often misses novel, emerging threats because it lacks contextual understanding.

The Solution: I developed Sentinells, an AI-powered log analysis pipeline. Instead of relying purely on static regex rules, the system ingests raw logs (from OpenSSH, Apache, Bind9, etc.), normalizes them, and feeds them into a locally hosted, fine-tuned Large Language Model (Llama 3). The LLM analyzes the logs contextually to determine threat severity and provides actionable recommendations.

The Impact: In testing, the system achieved a 92% True Positive detection rate for attacks like brute-force attempts and DoS, while keeping False Positives to just 4%. By intelligently filtering noise and providing context-aware alerts to a custom Flask dashboard, the system dramatically reduces analyst workload and Mean Time to Respond (MTTR).

System Architecture

flowchart LR subgraph Endpoint_Layer [Endpoint Layer] A[Log Sources: Apache, SSH] -->|Raw Logs| B(Python Log Scraper) B -->|Encrypt| C{Agent Security Module} end C -- Secure Transmission HTTPS --> D subgraph Analysis_Layer [Analysis Layer - Controller] D{Controller Security Module} -->|Decrypt| E[(SQLite Database)] E -->|Read Raw| F[Normalization Engine] F -->|Write Normalized| E E -->|Read Normalized| G[LLM Analysis Engine] G -->|Write Analysis| E end subgraph Presentation_Layer [Presentation Layer] E -->|Fetch Alerts| H[Flask Web Backend] H --> I[SOC Dashboard] end style Endpoint_Layer fill:#1e293b,stroke:#0ea5e9,stroke-width:2px style Analysis_Layer fill:#1e293b,stroke:#0ea5e9,stroke-width:2px style Presentation_Layer fill:#1e293b,stroke:#0ea5e9,stroke-width:2px

End-to-end data flow from log generation to analyst dashboard.

Technical Implementation (Deep Dive)

1. Secure Log Ingestion Pipeline

The system utilizes an agent-based architecture. A Python scraper deployed on endpoint machines continuously tails log files (e.g., /var/log/auth.log). To ensure data transit security, I implemented a custom cryptographic key exchange.

Upon registration, the agent shares its MAC address and public key. The controller uses the MAC address to derive a unique symmetric secret key using the BLAKE2b hashing algorithm, encrypts it using the agent's public key, and sends it back. All subsequent log payloads are encrypted using this unique shared secret before being transmitted via HTTPS to the central controller.

2. Normalization and LLM Inference

Feeding raw, noisy logs directly into an LLM wastes context tokens and degrades performance. Therefore, a Python Normalization Engine first extracts critical entities (IPs, timestamps, usernames) using Regex patterns stored in a patterns.json file.

The normalized data is then prompted to the local LLM instance. To achieve this, I used Ollama to host Meta's Llama 3.2:3B model locally. To optimize the model for cybersecurity tasks without hallucination, I performed supervised fine-tuning.

  • Fine-Tuning: I utilized the darkknight25/advanced_siem_dataset from HuggingFace, filtered for Linux-specific events. Training was conducted using the Unsloth framework on a Google Colab instance (NVIDIA T4 GPU) to adjust model weights for accurate severity classification.
  • Prompt Engineering: I designed specific system prompts instructing the model to output strict JSON containing `anomaly_type`, `severity`, `confidence`, and `summary`. The engine supports dynamic prompting modes (Single, Batch, or Contextual) depending on the log source type.

3. Role-Based Alert Dashboard

The final outputs are served via a custom Flask backend to a web dashboard. I implemented Role-Based Access Control (RBAC) mimicking a real SOC hierarchy:

  • Tier 1 (Triage): Only sees low/medium severity alerts to filter noise.
  • Tier 2 (Incident Response): Handles escalated high-severity alerts.
  • Tier 3 (Threat Hunters): Focuses exclusively on critical events.

The interface includes an alert lifecycle system where analysts can Acknowledge, Escalate, or Resolve threats, leaving an audit trail for accountability. A dedicated Log Explorer view allows analysts to review the exact raw logs that triggered an LLM inference.

Interested in discussing AI applications in cybersecurity?

Get In Touch