🛡️ Cyber

Machine Learning Pipeline for Cybersecurity Analysis

An end-to-end machine learning pipeline that ingests cybersecurity data from Google Sheets, processes it, and trains predictive models for threat detection and analysis.

---

📋 Table of Contents

• Overview
• Project Structure
• Features
• Prerequisites
• Installation
• Configuration
• Usage
• Data Pipeline
• Model
• Security Notice
• Contributing

---

🔍 Overview

Cyber is a Python-based machine learning project focused on cybersecurity data analysis. It connects to Google Sheets as a data source via a GCP service account, processes security-related datasets, and feeds them into a trained ML model for classification or anomaly detection tasks.

This project bridges data accessibility (via Google Sheets) and ML-powered security intelligence, making it easy to iterate on datasets and models without complex infrastructure.

---

📁 Project Structure

Cyber/
├── data/                          # Raw and processed datasets
│   └── ...                        # Security event data files
│
├── model/                         # Trained model artifacts
│   └── ...                        # Serialized model files (.pkl, .joblib, etc.)
│
└── README.md

Key Directories

Directory	Purpose
data/	Holds raw and pre-processed cybersecurity datasets used for training and evaluation
model/	Stores serialized model artifacts generated after training

---

✨ Features

• Google Sheets Integration — Pulls cybersecurity datasets directly from Google Sheets using the Google Cloud API, enabling collaborative and real-time data updates without touching local files.
• Automated Data Pipeline — Handles data ingestion, cleaning, and preprocessing in a structured workflow from raw input to model-ready format.
• ML Model Training — Trains a machine learning model on labeled cybersecurity data for tasks such as intrusion detection, anomaly classification, or threat scoring.
• Model Persistence — Serializes trained models to the model/ directory for reuse and deployment without retraining.
• GCP Service Account Auth — Uses Google Cloud service account credentials for secure, programmatic access to Google APIs.

---

🛠 Prerequisites

• Python 3.8 or higher
• A Google Cloud Platform project with the Google Sheets API and Google Drive API enabled
• A GCP service account with access to the relevant spreadsheet

---

📦 Installation

1. Clone the repository

git clone https://github.com/Swotty00/Cyber.git
cd Cyber

2. Create and activate a virtual environment (recommended)

python -m venv venv
source venv/bin/activate        # On Windows: venv\Scripts\activate

3. Install dependencies

pip install -r requirements.txt

If a requirements.txt is not present, the core dependencies are likely:

pip install gspread google-auth pandas scikit-learn numpy

---

⚙️ Configuration

This project uses a GCP service account to authenticate with Google APIs.

1. Go to Google Cloud Console
2. Create a service account under your project
3. Download the JSON key file
4. Rename it or reference it in your script
5. Share your Google Sheet with the service account email (e.g., sheets-ml@your-project.iam.gserviceaccount.com)

⚠️ Never commit your credentials file to version control. See the Security Notice below.

Store the credentials path in an environment variable:

export GOOGLE_APPLICATION_CREDENTIALS="path/to/your-service-account.json"

Or reference it directly in code:

import gspread
from google.oauth2.service_account import Credentials

creds = Credentials.from_service_account_file("your-credentials.json", scopes=[...])
client = gspread.authorize(creds)

---

🚀 Usage

1. Data Ingestion

Pull the latest cybersecurity data from Google Sheets:

python data/ingest.py

2. Train the Model

python model/train.py

3. Run Inference / Prediction

python model/predict.py --input data/sample.csv

Note: Script names may vary. Check the contents of data/ and model/ for the actual entry points.

---

🔄 Data Pipeline

Google Sheets (Source)
        │
        ▼
  GCP Service Account Auth
        │
        ▼
  Data Ingestion Script  (data/)
        │
        ▼
  Preprocessing & Feature Engineering
        │
        ▼
  Model Training          (model/)
        │
        ▼
  Serialized Model Artifact

The pipeline is designed to be re-run as new security data becomes available in the spreadsheet, allowing continuous model improvement.

---

🤖 Model

The model stored in model/ is trained on cybersecurity event data and is designed for tasks such as:

• Intrusion Detection — Classifying network events as benign or malicious
• Anomaly Detection — Identifying unusual patterns in security logs
• Threat Scoring — Assigning risk scores to events or entities

Model evaluation metrics (accuracy, precision, recall, F1) should be logged during training and can be extended with tools like MLflow or Weights & Biases.

🤝 Contributing

Contributions are welcome! To get started:

1. Fork the repository
2. Create a new branch (git checkout -b feature/your-feature)
3. Commit your changes (git commit -m 'Add your feature')
4. Push to the branch (git push origin feature/your-feature)
5. Open a Pull Request

Please make sure not to include any credentials or sensitive data in your contributions.

---

Made with 🐍 Python · Powered by Google Cloud · Built for Security