Lab result, re-enacted
Flagship, public repoNetwork, identity and AI agents
APIS: Adaptive Protective Immune System
Catches attackers moving inside a network, stolen credentials and hijacked AI agents. It learns a baseline for every device and, like a honeybee colony, never acts on a single anomaly signal: a pattern has to repeat, or different kinds of evidence have to agree.
- Network signals: NEW_PEER OFF_HOURS VOLUME_OUTLIER FANOUT_SPIKE
- Tested first on traffic I captured with tcpdump in a 3-VM lab, then on LANL's real public dataset
- Hardened against attacks on itself: alert flooding (it separated the real attack from 48 of 50 decoys), slow baseline poisoning, and log tampering, caught by a SHA-256 hash-chained audit trail
- The AI-agent layer's false-alarm rate was measured on 576 real tool calls across 99 sessions; its attack scenarios are hand-built
- Python
- FastAPI
- Anomaly detection
- MITRE ATT&CK
- LANL dataset
- tcpdump
79.2%fewer false positives on LANL network data (2,896 → 603)
96%stolen-credential detection (Pass-the-Hash / Ticket layer), 166 of 173
40%precision when both detectors agree, vs ~2% for either alone
236automated tests, including adversarial ones
Nine layers, modeled on a honeybee colony
- Guard CheckpointFast rules, no baseline needed
- The QueenBaseline for every device
- Alarm BroadcastShares raw detections
- Quorum ConsensusRepetition or mixed signals
- Hygienic CleanupRe-checks stale trust
- ContainmentIsolation, SIEM export
- Chemical MimicryPass-the-Hash and Ticket
- Collective OverwhelmLinks weak signals
- Agent BehaviourHijacked AI agents
