[THUGS(red)]

SynapseIDS

A network IDS built as a pipeline, not a signature set — packets become flows, flows become a 48-feature vector, a neural net calls the traffic.

Tooling wip
github.com open ↗

Most intrusion detection matches signatures; this one runs a pipeline. Packets are assembled into flows, each flow is reduced to a fixed 48-feature vector against a frozen schema, and a classifier sorts it into one of seven traffic classes. Phase one ships a readable rule-based model so a verdict can be explained before an ONNX model ever replaces it, and PCAP replay runs the identical path as live capture. Pure Go with an empty go.mod, cross-built for amd64, i386, arm64 and ARMv7 with .deb packaging. Still early — live NIC capture, trained models and persistence are on the roadmap, not in the binary — so feed it captures for now.

ids netflow machine-learning detection blue-team go

go to github.com