FYDP · NEDUET · CS&IT · 2025–2026

NEXTGEN-SIEM
AN AI-POWERED THREAT & ANOMALY DETECTION SYSTEM

Powered by Elastic Stack (ELK) with Isolation Forest unsupervised ML for real-time anomaly detection. Transforms passive monitoring into a proactive, intelligent SOC assistant that identifies zero-day threats and unknown attack patterns automatically.

ELK
STACK ENGINE
ISO-F
ML MODEL
5s
POLL INTERVAL
24/7
MONITORING
ALERT MONITORING ACTIVE — ELASTICSEARCH ENDPOINT: localhost:5000/alerts
01 LIVE ALERT FEED
HIGH PRIORITY
Brute Force Detected CRITICAL
SRC: 192.168.1.45DST: 10.0.0.1 14:22:07 UTC
Port Scan Activity HIGH
SRC: 10.10.5.23PORTS: 22,80,443,8080 14:19:33 UTC
Anomaly Score Elevated MEDIUM
MODEL: IsolationForestSCORE: -0.412 14:17:11 UTC
Unusual Login Time LOW
USER: jsmithHOST: WS-014 14:10:55 UTC
DNS Tunneling Pattern MEDIUM
SRC: 172.16.0.55QUERIES: 847/min 14:08:20 UTC
02 SYSTEM ARCHITECTURE
ELK STACK
Endpoint Logs Endpoint
Fleet server INGEST
Elasticsearch CORE INDEX
Isolation Forest (ML) anomaly_detector.pkl
Kibana Dashboard VISUALIZE
03 TECH STACK
🔍
Elasticsearch
LOG INDEXING / QUERY
📊
Kibana
VISUALIZATION / SOC UI
🤖
scikit-learn
ISOLATION FOREST ML
🐍
Python
ML PIPELINE / API
🛡️
Suricata
NETWORK IDS
🐳
Docker
CONTAINERIZED DEPLOY
04 SYSTEM METRICS
OPERATIONAL
MODEL ACCURACY 94.2%
FALSE POSITIVE RATE 6.8%
THREAT DETECTION 91.5%
LOG THROUGHPUT 12.4K/s
ELASTIC HEAP USAGE 61%
05 PROJECT TEAM
AY
Ayesha Yousuf
CR-22004
SA
Sheheryar Amir
CR-22008
MK
Maryam Khan
CR-22021
AK
Abdullah Khalid
CR-22027
Ms. Saadia Arshad
SUPERVISOR · LECTURER, CSIT
saadia@cloud.neduet.edu.pk
Dr. Muhammad Mubashir Khan
CO-SUPERVISOR · CHAIRMAN, CSIT
mmkhan@cloud.neduet.edu.pk
06 LIVE LOG STREAM
POLLING: 5s
elasticsearch://localhost:5000/alerts — LIVE FEED
14:22:07[HIGH]Brute force pattern — src:192.168.1.45 → 10.0.0.1 — 547 failed auth attempts
14:21:55[INFO]IsolationForest model inference: 1,240 events processed — 3 anomalous
14:21:30[MED]DNS query volume spike — 172.16.0.55 — 847 queries/min (threshold: 100)
14:20:12[OK]Anomaly index push successful → nextgen-siem-anomalies-2025.12
14:19:33[HIGH]Port scan — src:10.10.5.23 — targets: 22,80,443,3306,8080 — SYN flood
14:18:44[INFO]Elasticsearch GET /alerts — 200 OK — 14ms — hits: 127
14:17:11[MED]Anomaly score -0.412 flagged — endpoint WS-007 — process: powershell.exe
14:16:02[OK]Logstash pipeline healthy — 4,211 events/min — no dropped events
14:15:30[INFO]Suricata IDS: rule update complete — 45,321 signatures loaded
14:14:08[OK]Kibana dashboard refresh — all panels nominal — 0 errors
14:12:55[INFO]Model pkl loaded: anomaly_detector.pkl — contamination=0.05 — estimators=100
14:10:55[LOW]Off-hours login — user:jsmith — host:WS-014 — time:02:10 local
07 PROJECT PHASES
Problem Statement & Setup✓ DONE
Elastic SIEM Deployment✓ DONE
Agent Config & Data Collection✓ DONE
ML Model Development ✓ DONE
Model Training & Evaluation ✓ DONE
Elasticsearch Integration ✓ DONE
Dashboard & Alert Rules ✓ DONE
Testing & Deployment ✓ DONE
Documentation & Report ✓ DONE