SOC early warning
When the curve crosses 0.75 before anything has happened, triage becomes something you schedule rather than something that wakes you up.
See the intrusion before it happens
Every 30 seconds NIDRA turns each host's traffic into 45 numbers. It has learned how those numbers move, so it can run them forward three minutes and say where the host is heading. In the Wednesday replay that was 90 seconds of warning before the scan became an intrusion.
Built in the open, on public data
CIC-IDS2017
tshark
PyTorch
FastAPI
Redis
Docker
How we check
Does it beat guessing?
45-dim
host state
K=6
3-min horizon
×5
seed ensemble
<300 ms
CPU inference
Two baselines run alongside it: persistence, and the same model with the context shuffled.
See the numbersAttacks are trajectories.
A compromise takes minutes, not milliseconds
Recon, then a foothold, then movement sideways. Each step changes how the machine behaves, and it all happens before anything is taken.
One model, three jobs
Explore how it worksWhat the model actually does
Every 30 seconds it reads each host's traffic into a state vector, runs that state forward, and shows which features moved the projected risk. All of it on CPU.
The output is a number of seconds, not a verdict on something that already happened.
OBSERVE
From raw traffic to host state
We capture live network flows, aggregate them per host in 30-second windows, and convert the activity into a 45-dimensional state vector.
Why per-host, not per-flow?
A compromise unfolds over time on a machine — scanning, probing, foothold, lateral movement, exfiltration. Per-flow data shows only a slice. Per-host sequences reveal the trajectory.
The Observe stage
tshark
Live network flows
pcap · flow data
30 s
30-second window
per host
45-d
45-dim state vector
per host
Model input: 45-dimensional host state vector
The 45 features capture flow statistics, temporal patterns and protocol behaviours, giving the model a complete picture of what the host is doing in that 30-second window.
What-if simulation
The model can also simulate alternative futures (e.g., “what if the host starts scanning?”) to show how projected risk changes. This is a model-internal what-if — a question about the model, not the network.
PCAP or CSV in, forecast out
Runs offline. No API key, no cloud round trip.
Run a forecast
Drop a PCAP or CSV of flow records
CIC-IDS2017 slices work out of the box
Replay: Wednesday (60×)▾
Infiltration probability timeline
Serving
NIDRA Predictor
One interface with three methods: forecast, counterfactual, explain. It loads once and scores in under 300 ms on CPU, then hands back a risk curve, a predicted stage, and the flows behind them. Counterfactuals here are model-internal what-ifs.
How NIDRA helps: From Traffic to a Forecast
Four steps. About 1000 sampled futures per host, recomputed every 30 seconds.
Ingest & Encode
Traffic becomes state:
- Flow-level (NetFlow/IPFIX) and packet-level (tshark/PCAP) features
- 45-dim state vector per host per 30-second window
- 5 feature groups: flow, packet, graph, dynamics, activity
Learn the Dynamics
What the model learns:
- 2-layer GRU encoder + Gaussian transition model learns P(St+1 | St)
- Trained self-supervised — no attack labels
- 15-minute context window (L=30)
Simulate & Forecast
Roll the future forward:
- Recursive rollout, K=6 steps (3-minute horizon)
- ~500–1000 sampled trajectories via a 5-seed ensemble
- Maps predicted state to one of six lifecycle stages
Explain & Alert
Every forecast comes with its reasons:
- A risk score and the seconds of warning that go with it
- SHAP feature attribution + temporal saliency
- Flagged flows drill-down (flow bridge)
Benign
Recon
Initial Access
Lateral
C2
Exfil
6-stage attack lifecycle
Where the extra minutes matter
What you actually look at
Four views on the same forecast: the curve, the stage, the reasons behind it, and the numbers we are judged on.
CIC-IDS2017 · tshark · PyTorch
Forecast
The risk curve per host, and the seconds of warning on it.
NIDRA console · replay fixture
Breakdown by Stage
24Hosts Monitored
- benign17
- recon3
- initial_access2
- lateral1
- c21
- exfil0
Highest-Risk Hosts
| Host | Risk | Predicted stage | Lead time |
|---|---|---|---|
| 192.168.10.14 | 0.82 | lateral | 90 s |
| 192.168.10.51 | 0.77 | c2 | 60 s |
| 192.168.10.8 | 0.64 | initial_access | — |
| 192.168.10.25 | 0.41 | recon | — |
| 192.168.10.3 | 0.18 | benign | — |
Console mock with illustrative values — the live view ships with the replay demo.
Three things that could prove us wrong
Ablation
Persistence baseline
Can the model beat “the next window looks like this one”?
If persistence keeps up, the model is not earning its complexity. That result gets published and diagnosed rather than buried.
See metrics3 min
forecast horizon
K=6 windows30 s
state resolution
per hostFixed by design
45features per host state
Falsifiable
Heads train on observed states only, then freeze. Nothing forward-looking can come from anywhere else.
180sseconds of forecast horizon
Leak-free
Nothing after time t reaches the input. Normalisation is fitted on the training period and serialised.
<300ms max CPU inference
Reproducible
Pinned seeds, one config file, and the metrics committed next to the code.