AI-Assisted Intrusion Detection System
A tool that watches network traffic for attacks and explains what it found in plain language instead of raw technical alerts, so anyone, not just a security analyst, can understand what happened.
The problem
Suricata and similar intrusion detection engines produce technically accurate but highly raw alerts (protocol details, signature IDs, byte offsets) that only a trained analyst can interpret, leaving non-technical stakeholders unable to act on what was actually found.
The approach
Suricata inspects PCAP files and generates alerts, which are then passed to an AI model via API (the exact model isn't finalized yet; a Claude-family model is the current front-runner) to translate the technical findings into plain-language explanations. Those explanations are surfaced through a dashboard designed to be readable by non-technical viewers, not just security staff.
The plan
Still at the planning stage: the pipeline architecture (Suricata, then AI interpretation, then dashboard) is set, but implementation hasn't started yet. The next step is standing up the Suricata PCAP analysis pipeline before wiring in the AI layer.