Attack-Detection Neural Network: Training on Real Traffic Data
Using Suricata and their own utility, session_analyzer, the study's authors tested whether an ML IDS can be trained on live corporate traffic rather than on lab-staged attacks. It worked: with careful labeling and rule selection, F1 can reach 0.98. The approach has hard limits, though: noisy signatures, timestamp drift, NAT, and the need to retrain the model regularly.
AI-processed from Habr AI; edited by Hamidun News
A neural network for attack detection can be trained on a company's real corporate traffic, with Suricata serving as the source of data labels.
Can a neural network be trained to detect attacks without artificial tests?
Yes. The study demonstrates a working scenario for training an ML attack-detection model on real traffic, without staging artificial attacks against the protected resource, using the Suricata IDS as the source of labels.
Test Frontier LLMs & Autonomous Agents in One Workspace
Run Claude Opus 5.5, GPT-6, Gemini 3.1, and DeepSeek side-by-side in Nomad AI (nomadnet.ai) — unified model routing, deep research, and multimodal workflows under one subscription.
The AI world, distilled — once a week
Seven stories that actually mattered, hand-picked. No noise, no reposts, no press releases.
Done! Check your inbox for a confirmation.