guardd

guardd Linux向け機械学習駆動の行動異常検出（eBPF + Isolation Forestを使用） Guarddは低レベルのシステムイベント（プロセス実行、ネットワークアクティビティ）を収集し、時間ウィンドウの特徴ベクトルに集約し、機械学習モデルを使用して異常な動作を検出します。 Guarddは未知の脅威 の検出に重点を置いています !WARNING このプロジェクトは開発中です 機能と検出精度は現在も積極的に改善されています フィードバック、提案、貢献を歓迎します 動作の仕組み...

batea

Batea Batea（バテア）とは、金の採掘者が砂や砂利を洗って金塊を回収するために伝統的に使用する、木製または鉄製の浅い大きなパンのことです。 Batea は、異常検知アルゴリズムファミリーに基づく文脈駆動型ネットワークデバイスランキングフレームワークです。Batea の目標は、セキュリティチームが nmap スキャンレポートを使用して大規模ネットワーク内の 重要なネットワークアセットを自動的にフィルタリング できるようにすることです。私たちはこれらを Gold Nuggets（金塊） と呼んでいます。 Gold Nuggeting と Batea...

ThreatDetect

ThreatDetect ThreatDetect는 Streamlit 기반의 내부 위협 탐지 프로토타입으로, 직원 활동 데이터를 분석하여 잠재적인 위험 행동을 식별합니다. 학습된 XGBoost 분류기와 Isolation Forest 이상 탐지기를 함께 사용하여 조직 수준의 위험 요약과 설명 가능한 직원 수준의 인사이트를 제공합니다. 데모 이 앱은 Streamlit을 사용하여 로컬에서 실행할 수 있습니다. 배포된 데모는 다음에서 확인할 수 있었습니다: https://threatdetectcos720.streamlit.app/ 주요 ...

AegisUI: Behavioral Anomaly Detection for Structured User Interface Protocols in AI Agent Systems

AI agents that build user interfaces on the fly assembling buttons, forms, and data displays from structured protocol payloads are becoming common in production systems. The trouble is that a payload can pass every schema check and still trick a user: a button might say "View invoice" while its...

Towards Eco Friendly Cybersecurity: Machine Learning Based Anomaly Detection with Carbon and Energy Metrics

The rising energy footprint of artificial intelligence has become a measurable component of US data center emissions, yet cybersecurity research seldom considers its environmental cost. This study introduces an eco aware anomaly detection framework that unifies machine learning based network...

Unsupervised Anomaly Detection for Smart IoT Devices: Performance and Resource Comparison

The rapid expansion of Internet of Things IoT deployments across diverse sectors has significantly enhanced operational efficiency, yet concurrently elevated cybersecurity vulnerabilities due to increased exposure to cyber threats. Given the limitations of traditional signature-based Anomaly...

NegBLEURT Forest: Leveraging Inconsistencies for Detecting Jailbreak Attacks

Jailbreak attacks designed to bypass safety mechanisms pose a serious threat by prompting LLMs to generate harmful or inappropriate content, despite alignment with ethical guidelines. Crafting universal filtering rules remains difficult due to their inherent dependence on specific contexts. To...

Semi-Supervised Supply Chain Fraud Detection with Unsupervised Pre-Filtering

Detecting fraud in modern supply chains is a growing challenge, driven by the complexity of global networks and the scarcity of labeled data. Traditional detection methods often struggle with class imbalance and limited supervision, reducing their effectiveness in real-world applications. This...

QUIC-Exfil: Exploiting QUIC'S Server Preferred Address Feature to Perform Data Exfiltration Attacks

The QUIC protocol is now widely adopted by major tech companies and accounts for a significant fraction of today's Internet traffic. QUIC's multiplexing capabilities, encrypted headers, dynamic IP address changes, and encrypted parameter negotiations make the protocol not only more efficient,...

Zero-Day Botnet Attack Detection in IoV: a Modular Approach Using Isolation Forests and Particle Swarm Optimization

The Internet of Vehicles IoV is transforming transportation by enhancing connectivity and enabling autonomous driving. However, this increased interconnectivity introduces new security vulnerabilities. Bot malware and cyberattacks pose significant risks to Connected and Autonomous Vehicles CAVs, ...