Methodologies, Data, & Publications
Our commitment to radical transparency means sharing our findings. Explore our peer-reviewed articles, operational datasets from our honeypot arrays, and detailed documentation on our AI and defense architectures.
A comparative study on running Llama 3.2 and Mistral locally, outlining architectural requirements for zero-data-leakage environments.
Analysis of 847+ unique vulnerabilities captured via our honeypot array, resulting in 24 responsible CVE disclosures.
How we built a 5-stage ML pipeline using open-weight models to autonomously classify and mitigate zero-day exploit attempts.
A two-node defense model. The Hub runs AI workloads, SIEM correlation, and automated response. The Satellite operates at the edge — IDS/IPS, network analysis, and deception systems act as the first line of defense. Connected through encrypted mesh VPN.
Network intrusion detection with 105,000+ rules. Real-time packet inspection, protocol anomaly detection, and automatic threat blocking at wire speed.
Deep protocol analysis and traffic logging. Extracts metadata from every connection — SSH fingerprints, DNS queries, HTTP headers, TLS certificates, and anomalous behaviors.
Centralized security event management. Correlates alerts from all sources, file integrity monitoring, rootkit detection, and compliance auditing with severity-based escalation.
Collaborative threat intelligence with global IP reputation database. Community-driven block lists, behavior-based detection scenarios, and automated ban decisions.
Three specialized honeypots capturing attack patterns across SSH, Telnet, FTP, SMB, MSSQL, HTTP, SMTP, POP3, IMAP, and PostgreSQL protocols.
Self-learning anomaly detection. Processes data from all security layers — honeypot interactions, IDS alerts, network flows — to identify emerging attack patterns and automate response.
Security logs from honeypots, IDS, and network analysis flow through a machine learning pipeline that continuously learns attacker behavior patterns and adapts defenses automatically.
Three specialized deception systems emulate vulnerable services to capture real attack patterns, credential stuffing lists, and malware payloads across multiple protocols.
We collaborate with researchers, institutions, and organizations to advance the field of autonomous defense.