Have a try: https://jasonji.top/cyber/

A compact Flask-based demo for explainable intrusion detection using an XGBoost model and SHAP. The web UI displays sample network records, runs model predictions, and returns SHAP explanations (chart + values). An optional DeepSeek/OpenAI-compatible integration can produce concise natural-language explanations for operators.

Features

• Model Inference: Loads an XGBoost model from xgb_model.json and returns predictions via /cyber/predict.

• Explainability: Generates SHAP explanations and a PNG chart (served as base64) for each record.

• Web UI: Single-page frontend in static (index.html, app.js, styles.css) showing scrolling suspicious records and detailed views.

• LLM Integration (optional): Controlled by environment variables (e.g. DEEPSEEK_ENABLED, DEEPSEEK_API_KEY) to produce human-friendly explanations.

• Containerized: Provides a Dockerfile and example docker-compose.yml (maps host 6000 → container 5000) for deployment