Project Strike
A hybrid network intrusion detection system designed and built from the ground up. A spiking neural network reads the rhythm of the traffic, a rules engine checks hard signatures in parallel, and every alert leaves the sensor through an encrypted, tamper-evident channel to a SIEM.
Live traffic becomes a 13-feature behavioural vector covering protocol rates, port entropy, sequential-port ratio, burstiness, inter-arrival timing and TCP flag anomalies. It is rate-encoded into spike trains over 25 time-steps and fed through three layers of leaky integrate-and-fire neurons (64 → 32 → 5), trained with surrogate gradients in snnTorch.
A YAML signature engine runs alongside the network. When both engines flag the same attack within a two-second window, the alerts are fused into one full-confidence alert and duplicates are suppressed.
Alerts are linked over five-minute windows into multi-stage campaigns: reconnaissance cascades (ARP scan → port scan), scan-then-flood sequences, and many sources converging on one target.
A 2048-bit Diffie-Hellman key exchange with SHA-256 key derivation sets up the channel. Alerts are sent with AES-256-CBC and HMAC-SHA256 (encrypt-then-MAC), with a 60-second replay window. The SIEM only accepts alerts that pass the integrity check.
A Dockerised station and attacker network runs real ARP scans, UDP port scans, TCP Christmas-tree probes and UDP floods to prove detection end to end.