Zero-Day Detector
Catches attacks nobody has seen before by learning what normal looks like and flagging what departs from it.
- Kind
- Security analytics pipeline
- Year
- 2025
- Area
- Grids and guards
- Built with
- Python
- PyTorch
- LSTM autoencoder
- GNN
- Sysmon
- tshark
- 1 more
The question
How do you catch an attack when there is nothing to match it against?
This pipeline learns what ordinary activity looks like, so that anything which departs from it stands out.
Why it exists
A zero-day attack has no known signature. The system learns what normal behaviour looks like on an endpoint and its network, and flags what departs from it.
How it works
From raw telemetry to an alert
- 1
Collection
Two sources are read side by side.
- Endpoint
- Sysmon process, network and registry events.
- Network
- Packets captured with tshark, grouped into flows.
- 2
Features
Events are cut into five-minute windows and turned into numeric features and a device graph.
- 3
Models
Two models each score the window.
- LSTM autoencoder
- High reconstruction error means an unusual sequence of events.
- Graph attention network
- Scores how unusual a device’s connections are.
- 4
Score
An ensemble merges the two scores into one.
- 5
Response
Alerts go out through webhooks, and incidents are logged as training data.
Decisions
Two views, one score
A sequence model sees what happened on a machine over time, while a graph model sees how machines relate to each other. The ensemble uses a learned combiner by default and falls back to fixed weights.
Batch and streaming
The entry point has modes for a single file, for batches and for a streaming engine, so the same pipeline serves a replay and a live feed.
Alerts feed back into training
Incidents and false positives are written out, so the next round of training can learn from what the analyst decided.
Not built yet
- A dashboard on live data: the front-end pages show sample data for now
- Some connectors are still empty files: the Sysmon collector module, the Kafka producer and consumer and the Elasticsearch writer
Built with
Languages
- Python
Frameworks and libraries
- FastAPI
AI and models
- PyTorch
Infrastructure and services
- Sysmon
- tshark
Methods
- LSTM autoencoder
- GNN