Cybersecurity
An intrusion-detection pipeline for small networks: it reads flow logs, flags scans, beacons and exfiltration, and hands each alert to an analyst with the flows that triggered it.
How it works
What it does, and what it does not
- 01
Ingests NetFlow and IPFIX records from up to a dozen sensors and keeps a rolling 15-minute window per host.
- 02
Applies open detection rules with explicit thresholds for scans, beaconing and unusual outbound volume.
- 03
Enriches every alert with ASN, geolocation and the triggering flows, then queues it for a person to triage.
- Input
- NetFlow v9 / IPFIX
- Window
- 15 min per host
- Rules
- 42 open, versioned
- Test set
- replayable, labelled
- Throughput
- ~50k flows/s, 4 cores
- Output
- analyst queue + JSON
Known limits
- Sees flow metadata only. It does not inspect payloads, so command-and-control that looks like normal traffic can pass.
- Thresholds are tuned on the published test traffic; a very different network needs its own baseline.
- It raises alerts for people to triage. It never blocks traffic on its own.
Version and changelog
v1.4.2, and how it got here
Semantic versions. Changes that came out of review name the review that asked for them.
- v1.4.22026-09-30Current
- FixedNTP sync no longer triggers the beaconing rule (jitter check).
- v1.4.02026-08-12
- AddedASN and geolocation enrichment on every alert.
Review record
Internal → Community → Public
Every stage, its dates and what reviewers said, including the requests for changes. Each comment names the version it read.
Internal review (Institute)
2026-07-01 → 2026-07-06Passed to community- Editorial BoardInstitute
Installs from the README and processes the full test set.
✓ Accepted
Community review (Community)
2026-07-07 → 2026-08-302 accepted, after 1 change- Y. HakimReviewer · network security
Beaconing rule fires on NTP sync. Needs a jitter check.
Changes requested - B. SiregarReviewer · incident response
Alerts carry enough context to triage without another tool.
✓ Accepted
Public review (Public)
2026-09-01 → 2026-09-29No open objections · Verified- P. WidodoPublic
Reran the evaluation on a laptop; numbers match.
Comment
Cite this
Cite the version you used
Results can change between versions. Cite the version and the proof ID so a reader can open exactly what you saw.
Hakim, Y., Siregar, B. (2026). Cybersecurity intrusion-detection pipeline (v1.4.2) [Software]. Adaptive Institute. AI-PRF-0009. https://adaptive-institute.id/products/cybersecurity