Self-adaptive cyber-defense platform

The problem

Small teams collect logs from ten systems in different formats without being able to connect them, so an attack is only discovered weeks later. Ready-made detection rules also lag behind new threats.

How it works

1. AssemblyPulling logs from the systems and normalizing their format.
2. DetectionCombining known rules with an anomaly-detection model of normal behavior.
3. ResponseClassifying the incident, prioritizing it, and executing containment steps.
4. LearningGenerating a new rule from a confirmed incident and adding it.

Project features

• Unifying logs from different sources into one linkable format.
• Anomaly detection catches new behavior that no rule covers.
• Detection rules are generated from confirmed incidents, so the platform learns from experience.
• An attack simulator tests the defenses safely, instead of finding the gap during a real incident.

Expected challenges

These are the main obstacles to expect during the build, laid out clearly so you know them before you start.

• The attack simulator runs only on the user's own isolated environment and with written permission; running it outside that is an attack.
• False alarms make the platform useless: the analyst ignores them within a week.
• Log volume grows fast, and storage becomes the highest cost.
• Anomaly detection needs a learning period on a clean network; an intrusion during that time would be learned as normal behavior.

The consultation gives you a solution for each one.