Threat intelligence is only useful if you can understand it fast. Raw IP logs and JSON responses from security APIs tell you something — but staring at lines of data during an incident is the last thing you want to be doing.
That's what pushed me to build a Smart Cybersecurity Threat Visualizer — a dashboard that pulls live data from AbuseIPDB and VirusTotal, processes it, and renders it as interactive maps, charts, and risk summaries. The goal: turn noise into signal, visually.
Why These Two APIs?
AbuseIPDB maintains a community-driven database of IP addresses reported for malicious activity — brute force attacks, spam, port scanning, and more. Every IP comes with an abuse confidence score, country of origin, and report history.
VirusTotal aggregates results from 70+ antivirus engines and threat intelligence tools. You can query a URL, file hash, or IP and get a consolidated verdict from dozens of sources at once.
Together, they give you both network-level threat context and file/URL-level threat context — covering a wide surface area of real-world attacks.
How the System Works
1. Input Layer
The user submits an IP address, domain, or file hash through the dashboard interface. This can also be fed automatically from a log file or a honeypot session.
2. API Query Layer
The backend fires parallel requests to AbuseIPDB and VirusTotal. For IPs, it also hits IPStack to get geolocation data — country, city, latitude/longitude.
3. Processing Layer
Raw API responses get normalized into a unified threat object:
- Abuse confidence score (0–100)
- Geolocation coordinates
- Vendor detection ratio (e.g., 14/72 engines flagged this)
- Category tags (phishing, malware, botnet, etc.)
4. Visualization Layer
The processed data feeds into a world map (Leaflet.js) with pins for attack origin locations, a bar chart showing abuse score distributions, and a risk summary card with color-coded severity.
The Most Interesting Engineering Decision
Early on I had to choose between polling (querying APIs on a timer) and on-demand querying (only when a user submits something). Polling feels more "real-time" but burns through API rate limits fast — AbuseIPDB's free tier allows 1,000 checks/day.
I went with on-demand querying with a local cache layer. If the same IP was queried in the last 24 hours, the result is served from cache rather than hitting the API again. A small decision — but it's the kind of thing that separates a working demo from something you could actually deploy.
What the Visualization Reveals
Once you start running real IPs through it, patterns emerge quickly:
- Certain ASN ranges show up repeatedly in AbuseIPDB — bulk cloud providers whose IP blocks are routinely abused
- High VirusTotal detection ratios don't always correlate with high AbuseIPDB scores — the two sources catch different attack categories
- Geolocation clustering shows that attack origins are rarely random — there are clear geographic hotspots that shift over time
None of this is obvious when you're looking at raw API JSON. The visualization makes it immediately readable.
Tech Stack
- Backend: ASP.NET Core MVC (C#) for API routing and caching logic
- Frontend: Chart.js for bar/doughnut charts, Leaflet.js for the threat map
- APIs: AbuseIPDB, VirusTotal, IPStack, HaveIBeenPwned
- Styling: Bootstrap 5 with a dark security-themed UI
What I'd Do Differently
If I rebuilt this today, I'd swap the .NET backend for a Python FastAPI service. Python's ecosystem for threat intelligence tooling is richer and faster to iterate on. The visualization logic would stay the same — Chart.js and Leaflet are framework-agnostic anyway.
I'd also add a bulk upload feature — paste 50 IPs from a log file and get a batch threat report — which would make it genuinely useful during incident response.
Why This Kind of Tool Matters
Security teams are drowning in alerts. The bottleneck isn't data — it's interpretation speed. A well-designed visualization layer compresses the time between "something happened" and "I understand what happened and what to do next." That's the real value of building threat intelligence dashboards.