Skip to main content

​
Overview

ML Defender provides enterprise-grade network security focused on protecting critical infrastructure from ransomware and DDoS attacks. The system employs a multi-layer detection architecture combining machine learning models, heuristic analysis, and payload inspection.

​
Threats Protected Against

ML Defender actively detects and blocks the following attack categories:

​
DDoS Attacks

  • Volumetric attacks - High packet/byte rate detection
  • Protocol attacks - SYN floods, ACK floods, fragmentation attacks
  • Application layer attacks - HTTP floods, DNS amplification
  • Detection accuracy - 97.6% validated on CTU-13 dataset

​
Ransomware C2 Communication

  • Botnet command & control - External IP tracking and behavioral analysis
  • Lateral movement - SMB connection monitoring (>5 unique SMB targets)
  • Encrypted payload detection - Shannon entropy analysis (>7.0 bits)
  • Pattern matching - 30+ ransomware signatures (.onion, crypto APIs, ransom notes)

​
Port Scanning and Reconnaissance

  • Port scan detection - >15 unique destination ports from single source
  • Network mapping - Rapid connection attempts across IP ranges
  • Service enumeration - Systematic probing of common services

​
Known Malicious IPs

  • Autonomous blocking - IPSet/IPTables kernel-level enforcement
  • Real-time updates - Sub-microsecond detection latency
  • GeoIP intelligence - Source/destination location tracking
ML Defender achieved 97.6% detection accuracy on the CTU-13 Neris botnet dataset, a well-known ransomware behavioral benchmark used in academic research.

​
Threats NOT Protected Against

ML Defender has specific limitations. Understanding what the system does NOT protect against is critical for proper security architecture.

​
Zero-Day Exploits

  • No signature database - ML Defender uses behavioral analysis, not vulnerability signatures
  • Unknown attack patterns - Novel exploits without established behavioral patterns may evade detection
  • Mitigation - Combine with endpoint protection and patch management

​
Encrypted Malware Payloads (TLS/SSL)

  • TLS 1.2/1.3 traffic - Cannot inspect encrypted application data
  • Certificate validation - Does not perform SSL/TLS MITM inspection
  • Limitation - Can only analyze flow metadata (packet sizes, timing, connection patterns)
  • Mitigation - Deploy TLS inspection proxies for sensitive zones

​
Insider Threats

  • No authentication layer - ML Defender operates at network layer (L3/L4)
  • Authorized users - Cannot distinguish malicious from legitimate authenticated activity
  • Lateral movement - Limited visibility into user-level access patterns
  • Mitigation - Requires integration with IAM, SIEM, and user behavior analytics (UBA)

​
Physical Attacks

  • Out of scope - Network-based IDS cannot protect against physical access
  • Examples - USB malware injection, hardware implants, console access
  • Mitigation - Physical security controls and endpoint hardening

​
Detection Methodology

ML Defender employs a three-layer detection architecture combining multiple analysis techniques:

​
Layer 0: eBPF/XDP Payload Capture

  • 512-byte payload capture - First 512 bytes of Layer 4 payload per packet
  • Kernel-space filtering - Zero-copy design with eBPF verifier approval
  • Coverage - 99.99% of ransomware families based on typical packet sizes
  • Performance - Sub-microsecond latency per packet

​
Layer 1.5: PayloadAnalyzer (Thread-Local)

  • Shannon entropy analysis - Detects encrypted/compressed content (>7.0 bits)
  • PE executable detection - MZ/PE header recognition
  • Pattern matching - 30+ signatures:
    • .onion domains (Tor C2)
    • CryptEncrypt, CryptDecrypt API calls
    • Bitcoin addresses
    • Ransom note patterns (.encrypted, .locked, .cerber)
  • Lazy evaluation - 147x speedup: 1 μs (normal) vs 150 μs (suspicious)

​
Layer 1: FastDetector (10-Second Window)

  • External IP tracking - Detects C2 communication (>10 new IPs)
  • SMB lateral movement - Identifies ransomware spreading (>5 SMB connections)
  • Port scanning patterns - Catches reconnaissance (>15 unique ports)
  • RST ratio analysis - Spots aggressive behavior (>30%)
  • Latency - <1 μs per event (heuristic-based)

​
Layer 2: RansomwareFeatureProcessor (30-Second Aggregation)

  • DNS entropy analysis - DGA (Domain Generation Algorithm) detection
  • SMB connection diversity - Tracks lateral movement complexity
  • External IP velocity - Monitors rapid external communication
  • 83+ ML features - Comprehensive flow-based behavior profiling
  • 20 ransomware indicators - Specialized threat intelligence

​
Layer 3: RandomForest Models (Real-Time Inference)

  • 4 embedded models - DDoS, Ransomware, Traffic Classification, Anomaly Detection
  • 97.6% accuracy - Validated on CTU-13 dataset
  • Sub-microsecond inference - Production-grade performance
  • C++20 implementation - No Python overhead

​
Response Capabilities

​
Autonomous Blocking

ML Defender provides fully autonomous threat response without human intervention: 
# Threats detected → Automatically added to blacklist
sudo ipset list ml_defender_blacklist_test

# Example output:
# 192.168.1.100 timeout 3600
# 10.0.50.23 timeout 3600
# 172.16.1.45 timeout 3600

​
IPSet Enforcement

  • Hash table data structure - O(1) lookup complexity
  • Kernel-level blocking - No userspace overhead
  • Configurable timeout - Default 1 hour (3600 seconds)
  • Capacity - Up to 1,000 IPs (configurable to 500K)

​
IPTables Integration

# Automatic DROP rule creation
iptables -A INPUT -m set --match-set ml_defender_blacklist_test src -j DROP

# Logged with custom prefix
# iptables -A INPUT -m set --match-set ml_defender_blacklist_test src \
#   -j LOG --log-prefix "ML_DEFENDER_DROP: "

​
Fail-Closed Design

ML Defender follows a fail-closed security model: errors result in blocking, not allowing traffic. This prevents security bypass during failures but may impact availability.
Error handling philosophy:
  • Crypto decryption errors → Block and alert
  • IPSet capacity exceeded → Block and alert (older entries evicted)
  • Model inference errors → Block and alert
  • etcd connection lost → Continue with last known configuration

​
Validation Results

​
CTU-13 Dataset Testing

ML Defender was validated using the CTU-13 Neris botnet dataset from Czech Technical University:
MetricValueBenchmark
Detection Accuracy97.6%>95% target
False Positive Rate2.4%<5% target
Detection Latency<1 μs<10 μs target
Throughput1M+ pps100K pps target
Dataset characteristics:
  • Real ransomware behavior (Neris botnet)
  • Mixed with legitimate traffic
  • 10+ hours of network captures
  • 2M+ packets processed

​
Stress Testing (Day 52)

36,000 events across 4 progressive tests:
TestEventsRateCPU UsageResult
11,00042.6/secN/A✅ PASS
25,00094.9/secN/A✅ PASS
310,000176.1/sec41-45%✅ PASS
420,000364.9/sec49-54%✅ PASS
Cryptographic pipeline metrics: 
crypto_errors: 0              ← Perfect encryption/decryption
decompression_errors: 0       ← Perfect LZ4 pipeline
protobuf_parse_errors: 0      ← Perfect message parsing
ipset_successes: 118          ← First ~1000 blocked successfully
ipset_failures: 16,681        ← Capacity limit (not a bug)
max_queue_depth: 16,690       ← Backpressure handled gracefully
Zero cryptographic errors across 36,000 events demonstrates production-ready encryption pipeline integrity.

​
Production Stability (17-Hour Test)

November 2-3, 2025:
  • Runtime: 17h 2m 10s (61,343 seconds)
  • Packets processed: 2,080,549
  • Payloads analyzed: 1,550,375 (74.5%)
  • Peak throughput: 82.35 events/second
  • Memory footprint: 4.5 MB (stable, zero growth)
  • Crashes: 0
  • Memory leaks: 0
  • Status: ✅ PRODUCTION-READY

​
Security Architecture Recommendations

​
Defense in Depth

ML Defender should be deployed as part of a layered security strategy:
  1. Network perimeter - Firewall + ML Defender (DDoS/ransomware)
  2. TLS inspection - Proxy for encrypted traffic analysis
  3. Endpoint protection - EDR for zero-day and insider threats
  4. Authentication - IAM and MFA for user access control
  5. Monitoring - SIEM integration for correlation and forensics

​
Deployment Zones

Recommended placements:
  • Gateway mode - Dual-NIC deployment at network perimeter
  • Host IDS - On critical servers (databases, file servers)
  • DMZ protection - Between public and internal networks
  • Cloud VPC - Virtual network security groups

​
Integration Requirements

For comprehensive threat coverage, integrate with:
  • Threat intelligence feeds - IP reputation and indicators of compromise (IOCs)
  • SIEM platforms - Splunk, ELK, QRadar for event correlation
  • Incident response - Automated playbooks (SOAR integration)
  • Forensic tools - RAG ingester for natural language queries

​
Roadmap for Enhanced Protection

​
Priority 1: TLS Inspection (Planned)

  • JA3/JA4 TLS fingerprinting
  • Certificate validation
  • Encrypted traffic metadata analysis

​
Priority 2: Insider Threat Detection (Planned)

  • User behavior analytics (UBA) integration
  • Authentication log correlation
  • Lateral movement detection enhancements

​
Priority 3: Zero-Day Protection (Research)

  • Anomaly-based detection improvements
  • Behavioral baselining
  • AI-powered threat hunting

Build docs developers (and LLMs) love

Get started for freeTalk to us