SecureSpace

Network intrusion rules are written and tuned by hand — slow, reactive, and hard to keep current against evolving threats.

Hackathon timeframe; the need for the generated rules to actually run in a real IDS/IPS and feed a SIEM, not just exist on paper.

An ML model that generates Suricata IDS/IPS rules, integrated with the Wazuh SIEM for real-time threat monitoring, plus a custom VPN interface using SHA-256-encrypted exchange between monitored endpoints.

Automated rule generation trades some precision and explainability for coverage and speed — acceptable when paired with a SIEM that keeps a human in the loop on what fires.

Wired generation directly into Suricata and Wazuh so the system was demonstrably live, not theoretical; encrypted the endpoint channel rather than assuming a trusted network.

A working pipeline from model to live rule to SIEM alert — defense that adapts faster than hand-written rules.

Defensive tooling is only credible when it runs against real traffic. Building it as an offensive-minded engineer makes the rules sharper.