Security analytics · Digital services · 2025

Absher Insight AI

Explainable behavioural-risk prototype

Scores access events against explainable behavioural rules and surfaces unusual activity on an operations dashboard — built entirely on synthetic data.

Role
AI security solution contributor
Status
Hackathon prototype
Evidence
Public repository
Year
2025

Evidence

What a reviewer can check today — and what is not claimed.

Hackathon prototype
Status
Built during the Absher × Tuwaiq hackathon. An independent prototype on synthetic data — not affiliated with Absher or any government entity, and not a deployed security system.
Evidence
Not claimed
No production deployment, no government affiliation and no detection-accuracy figures are claimed.
Stack
  • Python
  • FastAPI
  • Pydantic
  • scikit-learn
  • pandas
  • NumPy

Context

Built during the Absher Tuwaiq Hackathon as an independent demonstration of proactive, explainable risk monitoring.

The problem

Account-takeover signals in digital services are behavioural: the right credentials used from an unusual place, at an unusual hour, at an unusual rate. Monitoring usually reacts after an incident, and analysts also need to know why an event was flagged.

Constraints

  • No real citizen data — every event is synthetic or simulated
  • Every flag has to explain itself
  • A hackathon timeline

Solution

A FastAPI service scores each access event with rules that state their reasoning — unusual location, late-night access, high action volume — and keeps live statistics that feed an operations dashboard. A simulator keeps the dashboard populated for demonstration.

My responsibility

AI security solution contributor

  • Contributed to the proactive, behaviour-based security concept
  • Helped shape the behavioural risk scenarios
  • Supported the dashboard and decision-support design
  • Kept the work privacy-first by building on synthetic data

Architecture & workflow

  1. 01 · Input

    Access event

  2. 02 · Processing

    Explainable rules

  3. 03 · Intelligence

    Risk flag with reasons

  4. 04 · Output

    Operations dashboard

How it works

  • A /predict endpoint receives service type, location, login time and action count
  • Rules check for unusual location, late-night access and high action volume
  • Each response returns the flag, a rule-assigned score and the reasons behind it
  • In-memory statistics expose totals, top services and a recent timeline
  • Joblib and scikit-learn utilities support anomaly-model experiments

Decisions

  • Proactive over reactive

    Designed around spotting risky behaviour early, rather than responding after something has already gone wrong.

  • Explainable rules before a black box

    The live path uses rules that return the reasons behind each flag. Model utilities stay experimental, and the rule-assigned score is never presented as a calibrated probability.

  • Privacy by design, on synthetic data

    Everything runs on synthetic behaviour, so the idea can be tested and demonstrated without touching real personal data.

Verified outcome

A runnable prototype: an endpoint that returns explainable rule-based flags, live statistics, a background simulator and a static dashboard, plus an API test for the response schema. No real-world detection performance is claimed.

Limitations

  • Synthetic data only — there is no production deployment and no affiliation with any government service.
  • Rules, not a trained detector: the model artifacts support experiments only.
  • State lives in memory and resets on restart; there is no persistent event store.
  • Tests cover the response schema, not detection quality.

What would come next

  • Replay realistic benchmark data to measure false-positive rates
  • Persist events and capture analyst feedback on each flag
  • Compare a trained anomaly model against the rule baseline

The idea, sketched

True innovation does not wait for the perfect moment. It creates it.
Concept visualizationIllustrative sketch of the idea — not a product screenshot.

Working on something similar?

Tell me about the problem, or pick the CV that fits the role — either way you’ll get a direct reply.