🔍 ThreatLens

AI-Powered Insider Threat Detection for Banking Systems

Detect. Explain. Contain. ThreatLens watches when no one else is watching.

• Problem Statement
• Live Demo
• How It Works
• Tech Stack
• How to Run Locally
• Project Structure
• Dataset
• Model Performance
• Known Limitations
• Team
• Contact

This project addresses PS1: AI-Driven Early Warning System for Internal & Privileged User Fraud.

Banking systems face severe vulnerabilities from privileged insiders — admins, branch staff, relationship managers, and IT teams — whose malicious actions blend seamlessly with normal operations and bypass traditional, externally-focused security perimeters.

ThreatLens is a real-time AI-powered Early Warning System that profiles behavioural baselines for individual privileged users, detects cross-silo anomalies (Core Banking, CRM, Treasury, Loans, Email) using an unsupervised Isolation Forest model, and deploys an Explainable AI Copilot (Gemini + Groq Llama 3.1) to translate every detected threat into an instant, actionable natural language incident summary — compressing SOC investigation time from hours to seconds.

Credentials for demo:

• SOC Analyst View → navigate to the Fraud Investigation Hub
• Manager View → navigate to the Manager Dashboard (kill-switch access)
• Trigger Live Events → use the Simulated Banking Portal to generate real-time anomalies through the full pipeline

┌─────────────────────────────────────────────────────────────────────────────┐
│                         THREATLENS PIPELINE                                 │
│                                                                             │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐    ┌──────────┐   │
│  │   Simulated  │    │   FastAPI    │    │  Isolation   │    │  Gemini  │   │
│  │   Banking    │───▶│   Gateway   │───▶│   Forest     │───▶│  + Groq │   │
│  │   Portal     │    │  (Async)     │    │  ML Engine   │    │  XAI     │   │
│  └──────────────┘    └──────────────┘    └──────────────┘    └────┬─────┘   │
│   Core Banking              │                   │                 │         │
│   CRM  |  Treasury          │              anomaly_score          │         │
│   Loans | Email       MongoDB Atlas         + is_anomaly          │         │
│                             │                   │                 │         │
│                       ┌─────▼─────────────────────────────────────▼──────┐  │
│                       │         React SOC Investigation Hub              │  │
│                       │   ForceGraph2D  |  Kill Switch  |  XAI Copilot   │  │
│                       └──────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────────────────┘

1. Ingest — The Simulated Banking Portal generates events across 5 silos; each event is POST'd to FastAPI with user ID, action type, amount, geo-location, and timestamp.
2. Detect — The Isolation Forest model scores every event against the behavioural baseline. Outliers (anomaly score < 0) are flagged instantly.
3. Explain — Gemini 2.5 Flash generates a full incident report. The Groq Llama 3.1 Copilot answers live SOC analyst questions in under 100ms.
4. Contain — The Manager Dashboard's kill switch immediately revokes the suspicious user's session.

• Node.js 20+
• Python 3.10+
• A MongoDB Atlas free-tier cluster
• Gemini API key (get at aistudio.google.com)
• Groq API key (get at console.groq.com)

1. Clone the repository

git clone https://github.com/AUG235772/ThreatLens
cd threatlens

2. Configure environment variables

# Create a .env file inside /backend
cp backend/.env.example backend/.env

Edit backend/.env:

MONGO_URI=your_mongodb_atlas_connection_string
GEMINI_API_KEY_1=your_gemini_api_key
GEMINI_API_KEY_2=your_gemini_api_key_2        # optional — used for rotation
GEMINI_API_KEY_3=your_gemini_api_key_3        # optional — used for rotation
GROQ_API_KEY=your_groq_api_key

3. Install backend dependencies and start the API

cd backend
pip install -r requirements.txt
uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload

API will be live at http://localhost:8000 OpenAPI docs at http://localhost:8000/docs

4. Install frontend dependencies and start the React app

# In a new terminal
cd frontend
npm install
npm run dev

App will be live at http://localhost:5173

# Build the image
docker build -t threatlens .

# Run with your environment variables
docker run -p 7860:7860 \
  -e MONGO_URI=your_mongo_uri \
  -e GEMINI_API_KEY_1=your_gemini_key \
  -e GROQ_API_KEY=your_groq_key \
  threatlens

Full app (UI + API) accessible at http://localhost:7860

threatlens/
│
├── 📂 backend/
│   ├── 📂 app/
│   │   └── main.py              ← FastAPI app: routes, ML inference, XAI engine, MongoDB connection
│   ├── requirements.txt         ← All Python dependencies
│   └── .env.example             ← Environment variable template
│
├── 📂 frontend/
│   ├── 📂 src/
│   │   ├── App.jsx              ← Root React component + routing
│   │   ├── 📂 components/       ← SOC Investigation Hub, Manager Dashboard, Simulated Portal
│   │   └── 📂 pages/            ← Page-level views
│   ├── package.json
│   └── vite.config.js
│
├── 📂 ml_engine/
│   ├── 📂 models/
│   │   ├── isolation_forest.pkl ← Trained Isolation Forest model (Joblib)
│   │   ├── le_action.pkl        ← LabelEncoder for action_type feature
│   │   └── le_geo.pkl           ← LabelEncoder for geo_location feature
│   └── model_training.ipynb    ← Full EDA + training pipeline notebook
│
├── 📂 assets/                   ← README screenshots (add yours here)
│
├── Dockerfile                   ← Multi-stage build (Node 20 → Python 3.10-slim)
└── README.md

All data is 100% synthetic, generated by Team Dhurandhars using the training notebook at /ml_engine/model_training.ipynb.

Features per event:

Normal profile: Business hours · Domestic geo (Mumbai, Delhi, Bangalore) · Routine actions (LOGIN_SUCCESS, VIEW_RECORD, DOMESTIC_TRANSFER) · Moderate INR amounts

Anomalous profile injected: Off-hours · Foreign geo (Moscow, Beijing, Dubai, Lagos) · Suspicious actions (BULK_EXPORT, UNAUTHORIZED_API_CALL, MASS_RECORD_ACCESS) · Extreme amounts

No real bank data was used at any stage.

⚠️ Note: Results are on synthetic data. Performance on real-world banking data would require re-training on actual institutional event logs with real behavioural baselines.

• Synthetic data only — The system relies on simulated event sequences rather than live enterprise event streams (e.g., Apache Kafka). All employee activity is synthetically generated and does not represent real bank telemetry.

• External LLM APIs — XAI features depend on Gemini and Groq APIs, which are subject to rate limiting (mitigated via 3-key rotation). These external APIs are not suitable for production environments containing real customer PII due to data privacy constraints.

• Single-container deployment — The current architecture is a single Docker container on Hugging Face Spaces. Production would require independent microservices, dedicated scaling, SSO/Active Directory authentication, and compliance-grade audit logging.

• No auto-retraining — The Isolation Forest is trained on a fixed dataset. User behavioural drift over time would require periodic retraining pipelines in production.

• No authentication — The SOC dashboard has no user login (acceptable for POC demonstration; not suitable for production deployment).