guardd

Guardd Detección de anomalías de comportamiento para Linux, impulsada por eBPF y aprendizaje automático. Guardd aprende cómo se comporta normalmente un host Linux y marca la actividad que difiere de esa línea base. Los sensores del kernel recopilan ejecuciones de procesos e intentos de conexión T...

batea

Batea Batea 是一种由木材或铁制成的大型浅盘，传统上被淘金者用来淘洗沙砾以回收金块。 Batea 是一个基于异常检测机器学习算法的上下文驱动网络设备排名框架。其目标是让安全团队能够使用 nmap 扫描报告 自动筛选出大型网络中有趣的网络资产 。我们将这些资产称为 金块 。 关于金块发现以及 Batea 背后科学的更多信息，请参见我们的白皮书这里。 工作原理 Batea 通过从 nmap 报告（XML）中构建所有设备的数值表示（numpy），然后应用异常检测方法来揭示金块。它可以通过向网络元素的数值表示添加特定特征（即有趣特性）来轻松扩展。...

ThreatDetect

ThreatDetect ThreatDetect 是一个基于 Streamlit 的内部威胁检测原型，用于分析员工活动数据并标记潜在风险行为。它使用训练好的 XGBoost 分类器结合孤立森林异常检测器，生成组织级风险摘要和可解释的员工级洞察。 演示 该应用可以使用 Streamlit 本地运行。之前发布了一个部署演示，地址为： https://threatdetectcos720.streamlit.app/ 主要功能 从上传的 CSV 文件进行批量风险检测 组织威胁摘要，包含数量、概率分布和风险等级 使用 SHAP 值对每位员工进行可解释性分析...

A Feature-Rich Embedded NIDS with EBPF/XDP: Detector and Architecture Trade-Offs

Distributed Denial-of-Service DDoS attacks remain a serious threat to transport networks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target. Recent work has yet to study the impact of the hosting software architecture on network monitoring...

When Relationships Break: Interpreting Network Traffic Anomalies Via Dependency Violations

Current research on security monitoring is increasingly focusing on machine-learning-based approaches, but caveats remain. In addition to huge computational overhead, one concern is the lack of insights into "why" alerts are raised. Existing interpretability approaches rely on feature attribution...

Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

Cloud environments built on Amazon Web Services face a structural security vulnerability: once a credential passes authentication, the resulting session is often treated as trusted for its entire duration. This assumption fails when credentials are stolen. We introduce the Explainable Adaptive Ze...

From CVE to CWE: Syscall-Based HIDS Generalisation

Host intrusion detection systems HIDS based on system-call traces are typically trained and evaluated against individual Common Vulnerabilities and Exposures CVE instances. In operational settings, however, defenders need to recognise new exploits of an already known type of weakness. We...

AegisUI: Behavioral Anomaly Detection for Structured User Interface Protocols in AI Agent Systems

AI agents that build user interfaces on the fly assembling buttons, forms, and data displays from structured protocol payloads are becoming common in production systems. The trouble is that a payload can pass every schema check and still trick a user: a button might say "View invoice" while its...

Towards Eco Friendly Cybersecurity: Machine Learning Based Anomaly Detection with Carbon and Energy Metrics

The rising energy footprint of artificial intelligence has become a measurable component of US data center emissions, yet cybersecurity research seldom considers its environmental cost. This study introduces an eco aware anomaly detection framework that unifies machine learning based network...

Unsupervised Anomaly Detection for Smart IoT Devices: Performance and Resource Comparison

The rapid expansion of Internet of Things IoT deployments across diverse sectors has significantly enhanced operational efficiency, yet concurrently elevated cybersecurity vulnerabilities due to increased exposure to cyber threats. Given the limitations of traditional signature-based Anomaly...

NegBLEURT Forest: Leveraging Inconsistencies for Detecting Jailbreak Attacks

Jailbreak attacks designed to bypass safety mechanisms pose a serious threat by prompting LLMs to generate harmful or inappropriate content, despite alignment with ethical guidelines. Crafting universal filtering rules remains difficult due to their inherent dependence on specific contexts. To...

Semi-Supervised Supply Chain Fraud Detection with Unsupervised Pre-Filtering

Detecting fraud in modern supply chains is a growing challenge, driven by the complexity of global networks and the scarcity of labeled data. Traditional detection methods often struggle with class imbalance and limited supervision, reducing their effectiveness in real-world applications. This...

QUIC-Exfil: Exploiting QUIC'S Server Preferred Address Feature to Perform Data Exfiltration Attacks

The QUIC protocol is now widely adopted by major tech companies and accounts for a significant fraction of today's Internet traffic. QUIC's multiplexing capabilities, encrypted headers, dynamic IP address changes, and encrypted parameter negotiations make the protocol not only more efficient,...

Zero-Day Botnet Attack Detection in IoV: a Modular Approach Using Isolation Forests and Particle Swarm Optimization

The Internet of Vehicles IoV is transforming transportation by enhancing connectivity and enabling autonomous driving. However, this increased interconnectivity introduces new security vulnerabilities. Bot malware and cyberattacks pose significant risks to Connected and Autonomous Vehicles CAVs, ...