Security analytics · Digital services · 2025
Absher Insight AI
Explainable behavioural-risk prototype
Flags risky sign-in behaviour early, with rules that explain every alert — built on synthetic data.
- Role
- AI security solution contributor
- Status
- Hackathon prototype
- Year
- 2025
- Code
- github.com/Abdulel3h/absher-insight
In brief
01The problem
An account takeover looks like a valid sign-in from an unusual place or hour, and an analyst needs to know why it was flagged.
02What was built
A FastAPI service scores each access event with rules that state their reasons, and feeds an operations dashboard as events arrive.
03My role
I helped shape the proactive-security idea and the risk scenarios, and supported the dashboard design and decision logic.
04Outcome
A runnable prototype with public code. Not affiliated with any government entity, and no accuracy figures are claimed.
How it works
01Input
Access event
02Processing
Explainable rules
03Intelligence
Risk flag with reasons
04Output
Operations dashboard
Decisions that shaped it
Proactive over reactive
Designed around spotting risky behaviour early, rather than responding after something has already gone wrong.
Explainable rules before a black box
The live path uses rules that return the reasons behind each flag. Model utilities stay experimental, and the rule-assigned score is never presented as a calibrated probability.
Privacy by design, on synthetic data
Everything runs on synthetic behaviour, so the idea can be tested and demonstrated without touching real personal data.
The honest part
Not claimed
No production deployment, no government affiliation and no detection-accuracy figures are claimed.
Limits today
- Synthetic data only — there is no production deployment and no affiliation with any government service.
- Rules, not a trained detector: the model artifacts support experiments only.
- State lives in memory and resets on restart; there is no persistent event store.
- Tests cover the response schema, not detection quality.
If it continued
- Replay realistic benchmark data to measure false-positive rates
- Persist events and capture analyst feedback on each flag
- Compare a trained anomaly model against the rule baseline
What you can verify
Built during the Absher × Tuwaiq hackathon. An independent prototype on synthetic data — not affiliated with Absher or any government entity, and not a deployed security system.
Stack
Python · FastAPI · Pydantic · scikit-learn · pandas · NumPy
“True innovation does not wait for the perfect moment. It creates it.”
The full recordContext, constraints and engineering notes, as written.
Context
Built during the Absher Tuwaiq Hackathon as an independent demonstration of proactive, explainable risk monitoring.
The problem
Account-takeover signals in digital services are behavioural: the right credentials used from an unusual place, at an unusual hour, at an unusual rate. Monitoring usually reacts after an incident, and analysts also need to know why an event was flagged.
What was built
A FastAPI service scores each access event with rules that state their reasoning — unusual location, late-night access, high action volume — and keeps live statistics that feed an operations dashboard. A simulator keeps the dashboard populated for demonstration.
Outcome
A runnable prototype: an endpoint that returns explainable rule-based flags, live statistics, a background simulator and a static dashboard, plus an API test for the response schema. No real-world detection performance is claimed.
Constraints
- No real citizen data — every event is synthetic or simulated
- Every flag has to explain itself
- A hackathon timeline
Responsibilities
- Contributed to the proactive, behaviour-based security concept
- Helped shape the behavioural risk scenarios
- Supported the dashboard and decision-support design
- Kept the work privacy-first by building on synthetic data
Engineering notes
- A /predict endpoint receives service type, location, login time and action count
- Rules check for unusual location, late-night access and high action volume
- Each response returns the flag, a rule-assigned score and the reasons behind it
- In-memory statistics expose totals, top services and a recent timeline
- Joblib and scikit-learn utilities support anomaly-model experiments