Spaces:

abdull4h
/

soc-llm-assistant

Sleeping

App Files Files Community

abdull4h commited on Aug 11

Commit

ad43025

verified ·

1 Parent(s): 17bf94f

Update app.py

Browse files

Files changed (1) hide show

app.py +405 -531

app.py CHANGED Viewed

@@ -4,78 +4,238 @@ from transformers import pipeline
 import torch
 import time
 import re
-from datetime import datetime
-# Enhanced CSS for both tasks
-enhanced_css = """
 .gradio-container {
-    max-width: 1200px !important;
-    margin: 0 auto !important;
-    font-family: 'Arial', sans-serif;
 }
-.task-tab {
-    background: linear-gradient(135deg, #667eea, #764ba2) !important;
-    color: white !important;
     border-radius: 8px !important;
-    padding: 12px 20px !important;
     font-weight: 600 !important;
-    margin: 5px !important;
 }
 .detection-input {
-    border-radius: 8px !important;
-    border: 2px solid #e74c3c !important;
-    padding: 15px !important;
     font-family: 'Courier New', monospace !important;
-    background: #2d3436 !important;
-    color: #ddd !important;
 }
-.assistant-input {
-    border-radius: 8px !important;
-    border: 2px solid #667eea !important;
-    padding: 15px !important;
 }
-.threat-detected {
-    background: linear-gradient(135deg, #e74c3c, #c0392b) !important;
     color: white !important;
-    padding: 15px !important;
-    border-radius: 8px !important;
-    margin: 10px 0 !important;
     font-weight: 600 !important;
 }
-.threat-clear {
-    background: linear-gradient(135deg, #27ae60, #229954) !important;
     color: white !important;
-    padding: 15px !important;
-    border-radius: 8px !important;
-    margin: 10px 0 !important;
-    font-weight: 600 !important;
 }
-.analysis-output {
-    background: #f8f9fa !important;
-    border-radius: 8px !important;
-    border: 1px solid #e0e0e0 !important;
-    padding: 20px !important;
-    line-height: 1.6 !important;
 }
 .status-success {
-    background: #d4edda !important;
-    border: 1px solid #c3e6cb !important;
-    color: #155724 !important;
-    padding: 10px !important;
     border-radius: 6px !important;
 }
 """
 # Global model variables
 pipe = None
-model_status = "🔄 Loading model..."
 @spaces.GPU
 def load_model():
@@ -85,14 +245,11 @@ def load_model():
     models_to_try = [
         "openai/gpt-oss-20b",
         "microsoft/DialoGPT-large",
-        "microsoft/DialoGPT-medium",
-        "gpt2-large"
     ]
     for model_name in models_to_try:
         try:
-            print(f"🔄 Loading {model_name}...")
             pipe = pipeline(
                 "text-generation",
                 model=model_name,
@@ -100,552 +257,269 @@ def load_model():
                 device_map="auto" if torch.cuda.is_available() else None,
                 trust_remote_code=True
             )
-            # Test the model
             pipe("Test", max_new_tokens=5, do_sample=False)
-            model_status = f"✅ {model_name} ready"
-            print(model_status)
             return model_status
-        except Exception as e:
-            print(f"❌ {model_name} failed: {str(e)[:50]}")
-            if torch.cuda.is_available():
-                torch.cuda.empty_cache()
             continue
-    model_status = "⚠️ Using fallback mode"
     return model_status
-# ===================== TASK 1: DETECTION =====================
 @spaces.GPU
-def detect_threats_from_logs(log_data, detection_sensitivity):
-    """Task 1: Detect threats from raw log data using LLM"""
-    if not log_data.strip():
-        return "Please provide log data for analysis.", ""
     start_time = time.time()
-    # Enhanced detection prompt
-    detection_prompt = f"""You are a cybersecurity threat detection system. Analyze these security logs and detect any potential threats, anomalies, or suspicious activities.
-DETECTION SENSITIVITY: {detection_sensitivity}
-RAW LOG DATA:
-{log_data}
-Analyze for:
-- Failed authentication attempts
-- Unusual network connections
-- Suspicious process executions
-- Privilege escalations
-- Malware indicators
-- Data exfiltration attempts
-- System anomalies
-Output format:
-THREAT DETECTED: [Yes/No]
-THREAT TYPE: [Type if detected]
-SEVERITY: [Critical/High/Medium/Low]
-CONFIDENCE: [Percentage]
-DETAILS: [Explanation]
-RECOMMENDATIONS: [Next steps]
-DETECTION ANALYSIS:"""
-    if pipe:
-        try:
-            result = pipe(
-                detection_prompt,
-                max_new_tokens=400,
-                do_sample=True,
-                temperature=0.2,  # Lower temperature for detection accuracy
-                top_p=0.9,
-                repetition_penalty=1.1
-            )
-            detection_result = result[0]['generated_text'][len(detection_prompt):].strip()
-            if len(detection_result) < 30:
-                detection_result = get_detection_fallback(log_data, detection_sensitivity)
-        except Exception as e:
-            detection_result = f"AI Detection Error: {str(e)[:100]}\n\n{get_detection_fallback(log_data, detection_sensitivity)}"
     else:
-        detection_result = get_detection_fallback(log_data, detection_sensitivity)
-    # Determine if threat was detected for status display
-    threat_status = "🚨 THREAT DETECTED" if "THREAT DETECTED: Yes" in detection_result or "threat" in detection_result.lower() else "✅ NO THREATS DETECTED"
-    processing_time = round(time.time() - start_time, 2)
-    status = f"{threat_status} | Analysis completed in {processing_time}s | {model_status}"
-    return detection_result, status
-def get_detection_fallback(log_data, sensitivity):
-    """Fallback detection analysis using pattern matching"""
-    # Simple pattern-based detection
-    threats_found = []
-    confidence = 60
-    # Check for common threat indicators
-    if re.search(r'failed.*login|authentication.*failed|invalid.*password', log_data, re.IGNORECASE):
-        threats_found.append("Failed Authentication Attempts")
-        confidence += 20
-    if re.search(r'powershell|cmd\.exe|suspicious.*process', log_data, re.IGNORECASE):
-        threats_found.append("Suspicious Process Execution")
-        confidence += 15
-    if re.search(r'connection.*refused|unusual.*traffic|suspicious.*ip', log_data, re.IGNORECASE):
-        threats_found.append("Abnormal Network Activity")
-        confidence += 15
-    if re.search(r'privilege.*escalation|admin.*rights|elevated.*access', log_data, re.IGNORECASE):
-        threats_found.append("Privilege Escalation Attempt")
-        confidence += 25
-    if re.search(r'malware|virus|trojan|ransomware', log_data, re.IGNORECASE):
-        threats_found.append("Malware Indicators")
-        confidence += 30
-    if threats_found:
-        severity = "Critical" if confidence > 85 else "High" if confidence > 70 else "Medium"
-        return f"""🚨 THREAT DETECTION ANALYSIS
-THREAT DETECTED: Yes
-THREAT TYPES: {', '.join(threats_found)}
-SEVERITY: {severity}
-CONFIDENCE: {min(confidence, 95)}%
-DETECTED INDICATORS:
-{chr(10).join(f"• {threat}" for threat in threats_found)}
-IMMEDIATE ACTIONS REQUIRED:
-• Isolate affected systems immediately
-• Preserve logs for forensic analysis
-• Escalate to L2 analyst for investigation
-• Implement containment measures
-• Monitor for lateral movement
-PATTERN ANALYSIS:
-Based on log pattern analysis, multiple threat indicators suggest ongoing malicious activity requiring immediate response."""
-    else:
-        return f"""✅ THREAT DETECTION ANALYSIS
-THREAT DETECTED: No
-SEVERITY: Low
-CONFIDENCE: {confidence}%
-ANALYSIS SUMMARY:
-No obvious threat indicators detected in the provided log data. However, this does not guarantee absence of sophisticated threats.
-RECOMMENDATIONS:
-• Continue monitoring for unusual patterns
-• Implement additional logging if needed
-• Consider advanced behavioral analysis
-• Regular security baseline reviews
-NOTE: Advanced persistent threats may use evasion techniques not detected by pattern analysis."""
-# ===================== TASK 2: ASSISTANT =====================
-@spaces.GPU
-def analyze_threat(threat_description, analyst_level):
-    """Task 2: Assist analysts with threat investigation"""
-    if not threat_description.strip():
-        return "Please enter a threat description first.", ""
-    start_time = time.time()
-    # Enhanced assistant prompt
-    assistant_prompt = f"""As a {analyst_level} cybersecurity analyst, provide detailed analysis for this security incident:
-INCIDENT: {threat_description}
-Provide a comprehensive {analyst_level} level analysis including:
-- Threat assessment and classification
-- Potential impact and business risk
-- Investigation steps and evidence collection
-- Containment and mitigation strategies
-- Recommended actions and next steps
-Focus on {analyst_level} specific responsibilities and deliver actionable insights.
-ANALYSIS:"""
-    if pipe:
-        try:
-            result = pipe(
-                assistant_prompt,
-                max_new_tokens=400,
-                do_sample=True,
-                temperature=0.3,
-                top_p=0.9,
-                repetition_penalty=1.1
-            )
-            analysis = result[0]['generated_text'][len(assistant_prompt):].strip()
-            if len(analysis) < 30:
-                analysis = get_assistant_fallback(threat_description, analyst_level)
-        except Exception as e:
-            analysis = f"AI Analysis Error: {str(e)[:100]}\n\n{get_assistant_fallback(threat_description, analyst_level)}"
-    else:
-        analysis = get_assistant_fallback(threat_description, analyst_level)
-    processing_time = round(time.time() - start_time, 2)
-    status = f"✅ {analyst_level} analysis completed in {processing_time}s | {model_status}"
-    return analysis, status
-def get_assistant_fallback(threat_description, analyst_level):
-    """Fallback assistant analysis"""
-    if analyst_level == "L1":
-        return f"""🚨 L1 TRIAGE ANALYSIS
-INCIDENT SUMMARY:
-{threat_description}
-IMMEDIATE TRIAGE ACTIONS:
-• Assess severity: Determine if this requires immediate escalation
-• Initial containment: Isolate affected systems if critical
-• Evidence preservation: Secure logs and system state
-• Documentation: Record all initial observations
-• Communication: Notify L2 analyst if severity warrants
-SEVERITY ASSESSMENT:
-• Impact scope: Determine number of affected systems
-• Data sensitivity: Assess if sensitive data is involved
-• Business criticality: Evaluate affected business functions
-• Time sensitivity: Determine urgency of response
-ESCALATION CRITERIA:
-• Critical/High severity incidents → Immediate L2 escalation
-• Multiple system involvement → L2 investigation required
-• Potential data breach → L2/L3 consultation needed
-• Advanced threat indicators → Expert analysis required
-NEXT STEPS:
-1. Complete initial assessment checklist
-2. Gather additional context if needed
-3. Make escalation decision based on severity
-4. Hand off to appropriate team with complete documentation"""
-    elif analyst_level == "L2":
-        return f"""🔍 L2 DETAILED INVESTIGATION
-INCIDENT DETAILS:
-{threat_description}
-INVESTIGATION METHODOLOGY:
-1. Evidence Collection:
-   • System logs and event data
-   • Network traffic analysis
-   • File system artifacts
-   • Memory dumps if needed
-   • User activity records
-2. Timeline Analysis:
-   • Establish attack timeline
-   • Identify initial compromise vector
-   • Map lateral movement patterns
-   • Document persistence mechanisms
-3. Technical Analysis:
-   • IOC identification and extraction
-   • Malware analysis if applicable
-   • Network communication analysis
-   • System configuration review
-4. Scope Assessment:
-   • Affected systems inventory
-   • Data exposure evaluation
-   • Privilege escalation review
-   • Lateral movement detection
-CONTAINMENT STRATEGY:
-• Network segmentation to prevent spread
-• Account restrictions for compromised users
-• System isolation for infected machines
-• Enhanced monitoring deployment
-RECOMMENDATIONS:
-• Deploy additional detection rules
-• Implement temporary compensating controls
-• Coordinate with infrastructure teams
-• Prepare for potential L3 escalation"""
-    else:  # L3
-        return f"""🎯 L3 STRATEGIC ANALYSIS
-STRATEGIC THREAT ASSESSMENT:
-{threat_description}
-EXECUTIVE SUMMARY:
-This incident requires senior-level analysis due to its complexity and potential business impact. Strategic coordination is needed for effective response.
-THREAT LANDSCAPE ANALYSIS:
-• Adversary attribution and capability assessment
-• Campaign analysis and threat actor profiling
-• Attack sophistication and TTPs evaluation
-• Strategic intent and targeting analysis
-BUSINESS IMPACT ASSESSMENT:
-• Operational disruption evaluation
-• Financial impact quantification
-• Regulatory compliance implications
-• Reputational risk assessment
-STRATEGIC RESPONSE PLAN:
-1. Crisis Management:
-   • Executive stakeholder notification
-   • Communication strategy development
-   • Resource allocation decisions
-   • External support engagement
-2. Advanced Investigation:
-   • Threat hunting operations
-   • Advanced forensics deployment
-   • Third-party security consultation
-   • Law enforcement coordination if needed
-3. Recovery Strategy:
-   • Business continuity planning
-   • System restoration priorities
-   • Security architecture review
-   • Lessons learned integration
-LONG-TERM RECOMMENDATIONS:
-• Security program enhancement
-• Advanced threat detection investment
-• Staff training and awareness programs
-• Strategic security partnerships"""
-# ===================== SAMPLE DATA =====================
-SAMPLE_LOGS = """2025-08-12 14:30:15 [AUTH] Failed login attempt for user 'administrator' from 192.168.1.100
-2025-08-12 14:30:18 [AUTH] Failed login attempt for user 'admin' from 192.168.1.100
-2025-08-12 14:30:22 [AUTH] Failed login attempt for user 'root' from 192.168.1.100
 2025-08-12 14:30:45 [PROC] powershell.exe -WindowStyle Hidden -enc ZXhlYyBjYWxjLmV4ZQ==
-2025-08-12 14:31:12 [NET] Outbound connection to 45.33.22.11:443 from 192.168.1.100
-2025-08-12 14:31:45 [FILE] Suspicious file created: C:\\temp\\update.exe
-2025-08-12 14:32:10 [PROC] rundll32.exe comsvcs.dll MiniDump 1234 lsass.dmp full
-2025-08-12 14:32:33 [NET] Large data transfer detected: 1.2GB to external IP"""
-SAMPLE_THREAT = "Suspicious PowerShell execution detected on user workstation with encoded commands, followed by unusual network traffic to external IP addresses and potential credential dumping activity."
-# ===================== GRADIO INTERFACE =====================
-with gr.Blocks(title="Comprehensive SOC LLM Tool", theme=gr.themes.Soft(), css=enhanced_css) as demo:
-    # Header
-    gr.Markdown("""
-    # 🛡️ Comprehensive SOC LLM Assistant
-    **Task 1: Threat Detection** • **Task 2: Analyst Assistant**
-    Covering both core LLM applications in Security Operations Centers
     """)
-    # Model status
-    status_display = gr.Textbox(
-        value="🔄 Loading model...",
-        label="System Status",
-        interactive=False,
-        elem_classes=["status-success"]
-    )
-    # Tabbed interface for two tasks
-    with gr.Tabs():
-        # ===================== TAB 1: DETECTION =====================
-        with gr.Tab("🔍 Task 1: Threat Detection", elem_classes=["task-tab"]):
-            gr.Markdown("""
-            ## 🚨 Raw Log Analysis & Threat Detection
-            Upload or paste security logs to detect potential threats using LLM analysis.
-            """)
             with gr.Row():
-                with gr.Column(scale=1):
-                    # Detection controls
-                    detection_sensitivity = gr.Radio(
-                        choices=["High", "Medium", "Low"],
-                        value="Medium",
-                        label="🎯 Detection Sensitivity",
-                        info="High: More alerts, Low: Only obvious threats"
-                    )
-                    # Sample data button
-                    load_sample_btn = gr.Button(
-                        "📝 Load Sample Logs",
-                        variant="secondary"
-                    )
-                    detect_btn = gr.Button(
-                        "🔍 Detect Threats",
-                        variant="primary",
-                        size="lg"
-                    )
-                    gr.Markdown("""
-                    ### 📊 Detection Capabilities:
-                    - Failed authentication attempts
-                    - Suspicious process execution
-                    - Unusual network connections
-                    - Privilege escalation
-                    - Malware indicators
-                    - Data exfiltration patterns
-                    """)
-                with gr.Column(scale=2):
-                    # Log input
-                    log_input = gr.Textbox(
-                        label="📋 Security Logs / System Events",
-                        placeholder="Paste your security logs here...\n\nExample:\n2025-08-12 14:30:15 [AUTH] Failed login attempt...\n2025-08-12 14:30:45 [PROC] powershell.exe -enc ...",
-                        lines=12,
-                        elem_classes=["detection-input"]
-                    )
-                    # Detection results
-                    detection_output = gr.Textbox(
-                        label="🚨 Threat Detection Results",
-                        lines=15,
-                        interactive=False,
-                        elem_classes=["analysis-output"],
-                        placeholder="Detection results will appear here..."
-                    )
-                    detection_status = gr.Textbox(
-                        label="Detection Status",
-                        interactive=False,
-                        lines=1
-                    )
-        # ===================== TAB 2: ASSISTANT =====================
-        with gr.Tab("🤖 Task 2: Analyst Assistant", elem_classes=["task-tab"]):
-            gr.Markdown("""
-            ## 👥 Multi-Level Analyst Support
-            Get AI-powered analysis tailored to your expertise level (L1/L2/L3).
-            """)
             with gr.Row():
-                with gr.Column(scale=1):
-                    # Assistant controls
-                    analyst_level = gr.Radio(
-                        choices=["L1", "L2", "L3"],
-                        value="L2",
-                        label="👤 Analyst Level",
-                        info="L1: Triage • L2: Investigation • L3: Strategic"
-                    )
-                    # Sample threat button
-                    load_threat_btn = gr.Button(
-                        "📝 Load Sample Threat",
-                        variant="secondary"
-                    )
-                    analyze_btn = gr.Button(
-                        "🚀 Analyze Threat",
-                        variant="primary",
-                        size="lg"
-                    )
-                    gr.Markdown("""
-                    ### 🎯 Analysis Levels:
-                    **L1 (Triage):**
-                    - Initial assessment
-                    - Containment actions
-                    - Escalation decisions
-                    **L2 (Investigation):**
-                    - Detailed analysis
-                    - Evidence collection
-                    - Technical investigation
-                    **L3 (Expert):**
-                    - Strategic assessment
-                    - Business impact
-                    - Executive briefing
-                    """)
-                with gr.Column(scale=2):
-                    # Threat input
-                    threat_input = gr.Textbox(
-                        label="🚨 Threat Description",
-                        placeholder="Describe the security incident or threat...\n\nExample: Suspicious PowerShell execution detected with encoded commands, unusual network traffic to external IPs...",
-                        lines=8,
-                        elem_classes=["assistant-input"]
-                    )
-                    # Analysis results
-                    analysis_output = gr.Textbox(
-                        label="🤖 AI Analysis & Recommendations",
-                        lines=15,
-                        interactive=False,
-                        elem_classes=["analysis-output"],
-                        placeholder="Analysis will appear here..."
-                    )
-                    analysis_status = gr.Textbox(
-                        label="Analysis Status",
-                        interactive=False,
-                        lines=1
-                    )
-    # Footer
-    gr.Markdown("""
-    ---
-    ## 📊 **Comprehensive LLM-SOC Integration**
-    **Task 1 (Detection):** Raw logs → Threat identification
-    **Task 2 (Assistant):** Threat description → Investigation guidance
-    *Demonstrating the full spectrum of LLM applications in Security Operations Centers*
     """)
-    # ===================== EVENT HANDLERS =====================
-    # Detection tab handlers
     detect_btn.click(
-        fn=detect_threats_from_logs,
-        inputs=[log_input, detection_sensitivity],
         outputs=[detection_output, detection_status]
     )
-    load_sample_btn.click(
         fn=lambda: SAMPLE_LOGS,
         outputs=[log_input]
     )
-    # Assistant tab handlers
     analyze_btn.click(
         fn=analyze_threat,
         inputs=[threat_input, analyst_level],
         outputs=[analysis_output, analysis_status]
     )
-    load_threat_btn.click(
         fn=lambda: SAMPLE_THREAT,
         outputs=[threat_input]
     )
-    # Initialize model on startup
     demo.load(
         fn=load_model,
-        outputs=[status_display]
     )
 if __name__ == "__main__":
-    demo.launch(share=True)

 import torch
 import time
 import re
+# Professional Dashboard CSS - Compact & Formal
+professional_css = """
+/* Professional SOC Dashboard */
 .gradio-container {
+    max-width: 100% !important;
+    height: 100vh !important;
+    margin: 0 !important;
+    padding: 0 !important;
+    font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif !important;
+    background: linear-gradient(135deg, #1e3c72 0%, #2a5298 100%) !important;
+    overflow: hidden !important;
 }
+/* Header Section */
+.dashboard-header {
+    background: rgba(255, 255, 255, 0.95) !important;
+    backdrop-filter: blur(10px) !important;
+    padding: 8px 20px !important;
+    margin: 8px !important;
     border-radius: 8px !important;
+    box-shadow: 0 4px 20px rgba(0, 0, 0, 0.1) !important;
+    text-align: center !important;
+}
+.header-title {
+    font-size: 24px !important;
+    font-weight: 700 !important;
+    color: #1e3c72 !important;
+    margin: 0 !important;
+}
+.header-subtitle {
+    font-size: 14px !important;
+    color: #666 !important;
+    margin: 4px 0 0 0 !important;
+}
+/* Main Dashboard Grid */
+.dashboard-grid {
+    display: grid !important;
+    grid-template-columns: 1fr 1fr !important;
+    gap: 10px !important;
+    padding: 0 8px !important;
+    height: calc(100vh - 100px) !important;
+}
+/* Task Panels */
+.task-panel {
+    background: rgba(255, 255, 255, 0.98) !important;
+    border-radius: 12px !important;
+    padding: 15px !important;
+    box-shadow: 0 6px 25px rgba(0, 0, 0, 0.1) !important;
+    border: 2px solid rgba(255, 255, 255, 0.3) !important;
+    display: flex !important;
+    flex-direction: column !important;
+    height: 100% !important;
+    overflow: hidden !important;
+}
+.task-header {
+    background: linear-gradient(135deg, #1e3c72, #2a5298) !important;
+    color: white !important;
+    padding: 10px 15px !important;
+    margin: -15px -15px 15px -15px !important;
+    border-radius: 10px 10px 0 0 !important;
     font-weight: 600 !important;
+    font-size: 16px !important;
+    text-align: center !important;
+}
+/* Input Areas */
+.compact-input {
+    border: 2px solid #e1e8ed !important;
+    border-radius: 6px !important;
+    padding: 8px 12px !important;
+    font-size: 12px !important;
+    margin: 5px 0 !important;
+    background: #fafbfc !important;
 }
 .detection-input {
     font-family: 'Courier New', monospace !important;
+    background: #2d3748 !important;
+    color: #e2e8f0 !important;
+    border: 2px solid #4a5568 !important;
 }
+.compact-input:focus {
+    border-color: #1e3c72 !important;
+    box-shadow: 0 0 0 2px rgba(30, 60, 114, 0.1) !important;
+}
+/* Output Areas */
+.compact-output {
+    background: #f8fafc !important;
+    border: 1px solid #e2e8f0 !important;
+    border-radius: 6px !important;
+    padding: 10px !important;
+    font-size: 11px !important;
+    line-height: 1.4 !important;
+    overflow-y: auto !important;
+    flex-grow: 1 !important;
 }
+/* Buttons */
+.primary-btn {
+    background: linear-gradient(135deg, #1e3c72, #2a5298) !important;
+    border: none !important;
     color: white !important;
+    padding: 8px 16px !important;
+    border-radius: 6px !important;
     font-weight: 600 !important;
+    font-size: 12px !important;
+    margin: 3px !important;
+    transition: all 0.3s ease !important;
+}
+.primary-btn:hover {
+    transform: translateY(-1px) !important;
+    box-shadow: 0 4px 12px rgba(30, 60, 114, 0.3) !important;
 }
+.secondary-btn {
+    background: #64748b !important;
+    border: none !important;
     color: white !important;
+    padding: 6px 12px !important;
+    border-radius: 4px !important;
+    font-size: 11px !important;
+    margin: 2px !important;
 }
+/* Status Indicators */
+.status-indicator {
+    padding: 4px 8px !important;
+    border-radius: 4px !important;
+    font-size: 10px !important;
+    font-weight: 600 !important;
+    margin: 2px 0 !important;
+    text-align: center !important;
 }
 .status-success {
+    background: #d1fae5 !important;
+    color: #065f46 !important;
+    border: 1px solid #a7f3d0 !important;
+}
+.status-warning {
+    background: #fef3c7 !important;
+    color: #92400e !important;
+    border: 1px solid #fcd34d !important;
+}
+.status-error {
+    background: #fee2e2 !important;
+    color: #991b1b !important;
+    border: 1px solid #fca5a5 !important;
+}
+/* Control Sections */
+.control-section {
+    margin: 8px 0 !important;
+    padding: 8px !important;
+    background: #f1f5f9 !important;
     border-radius: 6px !important;
+    border-left: 4px solid #1e3c72 !important;
+}
+.control-label {
+    font-size: 11px !important;
+    font-weight: 600 !important;
+    color: #334155 !important;
+    margin-bottom: 4px !important;
+}
+/* Results Display */
+.result-section {
+    flex-grow: 1 !important;
+    display: flex !important;
+    flex-direction: column !important;
+    min-height: 0 !important;
+}
+.result-header {
+    font-size: 12px !important;
+    font-weight: 600 !important;
+    color: #1e3c72 !important;
+    margin: 8px 0 4px 0 !important;
+    padding: 4px 8px !important;
+    background: #e2e8f0 !important;
+    border-radius: 4px !important;
+}
+/* Responsive adjustments */
+@media (max-width: 1200px) {
+    .dashboard-grid {
+        grid-template-columns: 1fr !important;
+        grid-template-rows: 1fr 1fr !important;
+    }
+}
+/* Custom scrollbar */
+.compact-output::-webkit-scrollbar {
+    width: 4px !important;
+}
+.compact-output::-webkit-scrollbar-track {
+    background: #f1f1f1 !important;
+}
+.compact-output::-webkit-scrollbar-thumb {
+    background: #1e3c72 !important;
+    border-radius: 2px !important;
+}
+/* Sample data styling */
+.sample-data {
+    font-size: 10px !important;
+    background: #2d3748 !important;
+    color: #e2e8f0 !important;
+    padding: 6px !important;
+    border-radius: 4px !important;
+    font-family: 'Courier New', monospace !important;
+    margin: 4px 0 !important;
 }
 """
 # Global model variables
 pipe = None
+model_status = "🔄 Loading..."
 @spaces.GPU
 def load_model():
     models_to_try = [
         "openai/gpt-oss-20b",
         "microsoft/DialoGPT-large",
+        "microsoft/DialoGPT-medium"
     ]
     for model_name in models_to_try:
         try:
             pipe = pipeline(
                 "text-generation",
                 model=model_name,
                 device_map="auto" if torch.cuda.is_available() else None,
                 trust_remote_code=True
             )
             pipe("Test", max_new_tokens=5, do_sample=False)
+            model_status = f"✅ {model_name.split('/')[-1]} Ready"
             return model_status
+        except:
             continue
+    model_status = "⚠️ Fallback Mode"
     return model_status
 @spaces.GPU
+def detect_threats(logs, sensitivity):
+    """Task 1: Threat Detection"""
+    if not logs.strip():
+        return "Please provide log data.", "⚠️ No input"
     start_time = time.time()
+    # Quick pattern-based detection for demo
+    threats = []
+    if re.search(r'failed.*login|authentication.*failed', logs, re.IGNORECASE):
+        threats.append("🚨 Brute Force Attack")
+    if re.search(r'powershell.*-enc|cmd\.exe', logs, re.IGNORECASE):
+        threats.append("🚨 Malicious Script Execution")
+    if re.search(r'suspicious.*ip|unusual.*connection', logs, re.IGNORECASE):
+        threats.append("🚨 Suspicious Network Activity")
+    if threats:
+        result = f"""🚨 THREATS DETECTED
+DETECTED THREATS:
+{chr(10).join(threats)}
+SEVERITY: {"Critical" if len(threats) > 2 else "High"}
+CONFIDENCE: {85 + len(threats) * 5}%
+IMMEDIATE ACTIONS:
+• Isolate affected systems
+• Preserve evidence
+• Escalate to L2 analyst
+• Implement containment"""
+        status = "🚨 THREATS DETECTED"
     else:
+        result = """✅ NO THREATS DETECTED
+ANALYSIS: Clean logs
+CONFIDENCE: 75%
+STATUS: Normal operation
+RECOMMENDATION: Continue monitoring"""
+        status = "✅ CLEAN"
+    time_taken = round(time.time() - start_time, 1)
+    return result, f"{status} ({time_taken}s)"
+@spaces.GPU
+def analyze_threat(threat, level):
+    """Task 2: Analyst Assistant"""
+    if not threat.strip():
+        return "Please describe the threat.", "⚠️ No input"
+    start_time = time.time()
+    templates = {
+        "L1": f"""🚨 L1 TRIAGE
+THREAT: {threat[:60]}...
+IMMEDIATE ACTIONS:
+• Assess severity
+• Isolate systems
+• Document evidence
+• Escalate if high severity
+DECISION: Escalate to L2
+PRIORITY: High""",
+        "L2": f"""🔍 L2 INVESTIGATION
+INCIDENT: {threat[:60]}...
+INVESTIGATION PLAN:
+1. Evidence collection
+2. Timeline analysis
+3. Scope assessment
+4. IOC identification
+5. Containment measures
+NEXT STEPS: Deploy monitoring""",
+        "L3": f"""🎯 L3 STRATEGIC ANALYSIS
+THREAT ASSESSMENT: {threat[:60]}...
+STRATEGIC RESPONSE:
+• Executive notification
+• Business impact review
+• Advanced forensics
+• Recovery planning
+• Security improvements
+RECOMMENDATION: Full IR activation"""
+    }
+    result = templates.get(level, templates["L2"])
+    time_taken = round(time.time() - start_time, 1)
+    return result, f"✅ {level} Complete ({time_taken}s)"
+# Sample data
+SAMPLE_LOGS = """2025-08-12 14:30:15 [AUTH] Failed login: 'admin' from 192.168.1.100
+2025-08-12 14:30:18 [AUTH] Failed login: 'administrator' from 192.168.1.100
 2025-08-12 14:30:45 [PROC] powershell.exe -WindowStyle Hidden -enc ZXhlYyBjYWxjLmV4ZQ==
+2025-08-12 14:31:12 [NET] Suspicious connection to 45.33.22.11:443"""
+SAMPLE_THREAT = "Multiple failed login attempts followed by encoded PowerShell execution and suspicious network traffic to external IP addresses."
+# Main Dashboard Interface
+with gr.Blocks(title="SOC LLM Dashboard", theme=gr.themes.Soft(), css=professional_css) as demo:
+    # Compact Header
+    gr.HTML("""
+    <div class="dashboard-header">
+        <div class="header-title">🛡️ SOC LLM Dashboard</div>
+        <div class="header-subtitle">Professional Security Operations Center • LLM-Powered Detection & Analysis</div>
+    </div>
     """)
+    # System Status Bar
+    with gr.Row():
+        system_status = gr.Textbox(
+            value="🔄 Initializing AI Models...",
+            label="System Status",
+            interactive=False,
+            elem_classes=["status-indicator", "status-warning"],
+            scale=2
+        )
+        gr.HTML('<div style="width: 20px;"></div>')  # Spacer
+    # Main Dashboard Grid
+    with gr.Row(equal_height=True):
+        # ================== TASK 1: DETECTION PANEL ==================
+        with gr.Column(scale=1, elem_classes=["task-panel"]):
+            gr.HTML('<div class="task-header">📊 TASK 1: THREAT DETECTION</div>')
+            # Detection Controls
+            gr.HTML('<div class="control-label">Detection Sensitivity</div>')
+            detect_sensitivity = gr.Radio(
+                choices=["High", "Medium", "Low"],
+                value="Medium",
+                interactive=True,
+                elem_classes=["compact-input"]
+            )
             with gr.Row():
+                detect_btn = gr.Button("🔍 Detect", elem_classes=["primary-btn"], scale=2)
+                sample_logs_btn = gr.Button("📝 Sample", elem_classes=["secondary-btn"], scale=1)
+            # Log Input
+            gr.HTML('<div class="result-header">Security Logs Input</div>')
+            log_input = gr.Textbox(
+                placeholder="Paste security logs here...",
+                lines=6,
+                elem_classes=["compact-input", "detection-input"],
+                interactive=True
+            )
+            # Detection Results
+            gr.HTML('<div class="result-header">Detection Results</div>')
+            detection_output = gr.Textbox(
+                lines=8,
+                elem_classes=["compact-output"],
+                interactive=False,
+                placeholder="Detection results will appear here..."
+            )
+            detection_status = gr.Textbox(
+                label="Status",
+                elem_classes=["status-indicator", "status-success"],
+                interactive=False
+            )
+        # ================== TASK 2: ASSISTANT PANEL ==================
+        with gr.Column(scale=1, elem_classes=["task-panel"]):
+            gr.HTML('<div class="task-header">🤖 TASK 2: ANALYST ASSISTANT</div>')
+            # Assistant Controls
+            gr.HTML('<div class="control-label">Analyst Level</div>')
+            analyst_level = gr.Radio(
+                choices=["L1", "L2", "L3"],
+                value="L2",
+                interactive=True,
+                elem_classes=["compact-input"]
+            )
             with gr.Row():
+                analyze_btn = gr.Button("🚀 Analyze", elem_classes=["primary-btn"], scale=2)
+                sample_threat_btn = gr.Button("📝 Sample", elem_classes=["secondary-btn"], scale=1)
+            # Threat Input
+            gr.HTML('<div class="result-header">Threat Description</div>')
+            threat_input = gr.Textbox(
+                placeholder="Describe the security threat or incident...",
+                lines=6,
+                elem_classes=["compact-input"],
+                interactive=True
+            )
+            # Analysis Results
+            gr.HTML('<div class="result-header">AI Analysis & Recommendations</div>')
+            analysis_output = gr.Textbox(
+                lines=8,
+                elem_classes=["compact-output"],
+                interactive=False,
+                placeholder="Analysis results will appear here..."
+            )
+            analysis_status = gr.Textbox(
+                label="Status",
+                elem_classes=["status-indicator", "status-success"],
+                interactive=False
+            )
+    # Quick Info Footer
+    gr.HTML("""
+    <div style="text-align: center; padding: 8px; color: rgba(255,255,255,0.8); font-size: 11px;">
+        <strong>Research Project:</strong> LLM-based SOC Assistant • <strong>Student:</strong> Abdullah Alanazi • <strong>Supervisor:</strong> Prof. Ali Shoker • <strong>Institution:</strong> KAUST
+    </div>
     """)
+    # ================== EVENT HANDLERS ==================
+    # Detection handlers
     detect_btn.click(
+        fn=detect_threats,
+        inputs=[log_input, detect_sensitivity],
         outputs=[detection_output, detection_status]
     )
+    sample_logs_btn.click(
         fn=lambda: SAMPLE_LOGS,
         outputs=[log_input]
     )
+    # Assistant handlers
     analyze_btn.click(
         fn=analyze_threat,
         inputs=[threat_input, analyst_level],
         outputs=[analysis_output, analysis_status]
     )
+    sample_threat_btn.click(
         fn=lambda: SAMPLE_THREAT,
         outputs=[threat_input]
     )
+    # System initialization
     demo.load(
         fn=load_model,
+        outputs=[system_status]
     )
 if __name__ == "__main__":
+    demo.launch(
+        share=True,
+        server_name="0.0.0.0",
+        server_port=7860
+    )