zarrarkhan1987/soc-ai

SOC AI – Multi-Model Detector (Hugging Face Space)

This Space loads all models from [`zarrarkhan1987/soc-detection-models`](https://huggingface.co/zarrarkhan1987/soc-detection-models) and lets you test them on CSV logs:

• —IDS (binary) – soc_ids_model_clean.pkl
• —Attack Type (multi-class) – soc_attack_model_v2.pkl (+ soc_scaler_v2.pkl, soc_labelencoder_type_v2.pkl)
• —EDR (Sysmon/LMD) – soc_edr_model.pkl (+ soc_edr_scaler.pkl)
• —Network (UNSW-NB15) – soc_network_model_unsw.pkl (+ soc_network_scaler_unsw.pkl, soc_network_labelencoder_unsw.pkl)
• —MITRE mapping – mitre_mapping.json / mitre_mapping.yml

How it works

• —Upload a CSV (NF/Zeek/UNSW-NB15 for network; Sysmon/LMD for endpoint).
• —The app aligns features to each model’s scaler (feature_names_in_) when present and fills missing columns with 0.
• —Returns predictions plus MITRE ATT&CK mapping for applicable labels.

For best results, use the same schema as during training. The app will still run with partial columns by falling back to a safe numeric subset.

Notes

• —Models are downloaded at runtime using huggingface_hub.hf_hub_download.
• —If your repo is private, set HF_TOKEN in the Space secrets.

License

Apache-2.0