ARGUS

Behavioral anomaly detection for access and connection logs. Uses a GRU sequence model combined with LightGBM to flag suspicious entity behavior and assign a calibrated risk score.

---

Layout

data_gen/       log generator (7 attack patterns)
features/       feature engineering (geo-velocity, off-hours, novelty, etc.)
profiler/       per-entity baseline with 30-day decay
models/         GRU detector + LightGBM classifier
scoring/        risk fusion: GRU 45%, classifier 40%, rules 15%
pipeline/       inference orchestration
dashboard/      Streamlit console
config.yaml     all hyperparameters in one place
run.sh          setup and launch

What it detects

Pattern	Signal	MITRE
Brute force	high auth failure rate	T1110
Credential stuffing	distributed failed logins	T1110.004
Impossible travel	geo-velocity > threshold	T1078
Lateral movement	cross-system resource access	T1021
Device spoofing	fingerprint mismatch	T1553
Low-and-slow exfil	gradual data transfer	T1029
Insider drift	baseline deviation over time	T1078.003

Running it

The script handles everything: venv setup, data gen, feature engineering, training, scoring, and launching the dashboard. Intermediate outputs are cached so re-runs skip completed steps.

Model notes

GRU is trained only on normal events. High reconstruction error on unseen sequences gets flagged. LightGBM handles multi-class classification with balanced class weights to deal with the skewed anomaly ratio. Entity profiles update using exponential decay so the baseline shifts gradually rather than jumping on a single event. New entities get a cold-start flag for their first 5 events.

Stack

Python 3.12, PyTorch (CPU build), LightGBM, Streamlit, Plotly, pandas, scikit-learn, SHAP