RediGuard: AI-Powered Real-Time Security Monitoring with Redis 8

Ajit Patil — Sun, 10 Aug 2025 16:29:33 +0000

This is a submission for the Redis AI Challenge: Real-Time AI Innovators.

What I Built

RediGuard is an innovative AI-powered cybersecurity platform that leverages Redis 8 as its real-time data layer to provide intelligent threat detection, anomaly analysis, and conversational security insights. Going far beyond simple chatbots, RediGuard combines multiple cutting-edge AI techniques with Redis 8's advanced features to create a comprehensive security monitoring solution that processes, analyzes, and responds to security events in real-time.

The system processes security events in real-time, applies AI-powered anomaly detection using Isolation Forest algorithms, and uses vector similarity search to correlate related threats. It features a modern dashboard that provides security analysts with immediate visibility into potential threats, complete alert management workflows, and comprehensive Redis 8 performance monitoring.

🚀 Key Features

Real-Time Threat Detection Engine

ML-powered anomaly detection using Isolation Forest algorithms
Geographic impossibility detection for suspicious login patterns
Behavioral embedding analysis for user pattern recognition
Real-time risk scoring with dynamic thresholds

AI-Powered Security Assistant

Conversational AI interface with contextual security awareness
Instant threat explanations with business-friendly language
Interactive threat analysis directly embedded in alert cards
Security context-aware responses using current system data

Advanced Analytics Dashboard

Real-time visualization of security events and trends
Interactive alert management with AI-enhanced explanations
User behavior analytics with vector similarity search
Geographic anomaly detection with time-series analysis

Intelligent Data Processing

Real-time streaming of security events through Redis Streams
Vector similarity search for behavioral pattern matching
Time-series analytics for trend identification
JSON-based complex data structures for rich alert metadata

Demo

🌐 Github Repo: https://github.com/ajitpdevops/rediguard
🌐 Application: Frontend runs on http://localhost:3000 with backend API at http://localhost:8000

Screenshots

Here is the demo I uploaded on Youtube

Demo Video Features

Real-Time Processing: Watch as login events stream through Redis and trigger immediate AI analysis
Vector Search in Action: See how user behavioral patterns are matched using cosine similarity
Conversational AI: Ask the security assistant about current threats and receive contextual responses
Instant Threat Analysis: Click "Explain" on any alert to get AI-powered business-friendly explanations

How I Used Redis 8

RediGuard showcases Redis 8's most advanced AI-focused capabilities in a real-world security monitoring scenario:

🔍 Redis Search with Vector Similarity

Behavioral Embedding Analysis:

# Create vector index for behavior embeddings
self._exec(
    "FT.CREATE", "embeddings_idx",
    "ON", "HASH",
    "PREFIX", "1", "embeddings:",
    "SCHEMA",
    "user_id", "TEXT",
    "timestamp", "NUMERIC", 
    "embedding", "VECTOR", "HNSW", "6",
    "TYPE", "FLOAT32",
    "DIM", "128",
    "DISTANCE_METRIC", "COSINE"
)

Impact: Enables real-time behavioral pattern matching to detect when users deviate from their normal activity patterns. The HNSW algorithm provides sub-millisecond similarity search across thousands of user behavioral vectors.

📊 Redis TimeSeries for Anomaly Tracking

Real-Time Risk Scoring:

# Store anomaly scores with automatic retention
self._exec("TS.CREATE", f"anomaly_scores:{user_id}",
          "RETENTION", "604800000",  # 1 week
          "LABELS", "user_id", user_id)

# Add real-time score updates
self._exec("TS.ADD", f"anomaly_scores:{user_id}", 
          timestamp, anomaly_score)

Impact: Tracks user risk scores over time, enabling trend analysis and early threat detection. Automatic data retention ensures optimal performance while maintaining historical context.

🔍 Redis Search for Complex Alert Queries

Advanced Alert Indexing:

# JSON-based alert indexing for complex queries
self._exec(
    "FT.CREATE", "alerts_idx",
    "ON", "JSON",
    "PREFIX", "1", "alert:",
    "SCHEMA",
    "$.user_id", "AS", "user_id", "TEXT",
    "$.ip", "AS", "ip", "TEXT",
    "$.score", "AS", "score", "NUMERIC", 
    "$.location", "AS", "location", "TEXT",
    "$.geo_jump_km", "AS", "geo_jump_km", "NUMERIC"
)

Impact: Enables lightning-fast complex queries across security alerts, supporting real-time dashboard updates and instant alert correlation.

📡 Redis Streams for Real-Time Event Processing

High-Throughput Event Ingestion:

# Process security events in real-time
async def process_event_stream():
    while True:
        events = await redis_client.xreadgroup(
            "security_processors", "processor_01",
            {"security_events": ">"}, 
            count=10, block=1000
        )
        for event in events:
            await analyze_and_alert(event)

Impact: Processes thousands of security events per second with guaranteed delivery and automatic partitioning across multiple consumers.

🎯 Redis JSON for Rich Data Structures

Complex Alert Metadata:

# Store rich alert context in JSON
alert_data = {
    "alert_id": "alert_001",
    "threat_intelligence": {
        "geographic_risk": "high",
        "ip_reputation": "suspicious",
        "behavioral_deviation": 0.92
    },
    "ml_analysis": {
        "confidence": 0.95,
        "features": [...],
        "similar_events": [...]
    }
}
await redis_client.json().set(f"alert:{alert_id}", ".", alert_data)

Impact: Stores complex, nested security data efficiently while maintaining queryability and enabling rich AI context for threat analysis.

🤖 AI Integration Architecture

Semantic Caching for LLM Performance:

# Cache LLM responses for similar security contexts
cache_key = f"llm_cache:{hash(security_context)}"
cached_response = await redis_client.get(cache_key)

if not cached_response:
    response = await llm_service.analyze_threat(context)
    await redis_client.setex(cache_key, 3600, response)  # 1 hour cache

Impact: Dramatically reduces LLM API costs and latency by caching contextually similar security analyses, while ensuring fresh insights for new threat patterns.

🔄 Real-Time Feature Streaming for ML

Live ML Feature Pipeline:

# Stream ML features for real-time model inference
features = extract_behavioral_features(login_event)
await redis_client.hset(f"features:{user_id}", mapping={
    "time_features": features.time_patterns,
    "geo_features": features.geographic_data,
    "behavior_features": features.behavioral_metrics
})

# Real-time anomaly scoring
anomaly_score = ml_model.predict(features)

Impact: Enables real-time ML inference with sub-100ms latency by streaming features directly through Redis, supporting immediate threat detection and response.

🚀 Why This Showcases Redis 8's AI Power

Redis 8's combination of vector search, time-series analytics, JSON storage, and streaming capabilities creates the ideal foundation for AI-powered security monitoring:

Unified Data Layer: Single platform for vectors, time-series, documents, and streams
Real-Time Performance: Microsecond latency enables immediate threat response
AI-Native Features: Built-in vector search and JSON handling optimize AI workflows
Horizontal Scale: Handles enterprise-level security event volumes
Developer Experience: Rich ecosystem and intuitive APIs accelerate development

Technical Architecture

System Components

Frontend: Next.js 15 with Tailwind CSS and shadcn/ui components
Backend: FastAPI with Redis Stack integration
AI/ML: Isolation Forest for anomaly detection, scikit-learn for feature engineering
Database: Redis Stack 8 (Streams, Vector Search, TimeSeries, JSON, Search)
Monitoring: Real-time dashboards with Recharts visualization

RediGuard demonstrates how Redis 8 can power the next generation of AI applications that go beyond simple chatbots to deliver real business value through intelligent, real-time data processing and analysis.

Forem: Ajit Patil