Detects suspicious coordination between machines on your network by comparing their traffic timing patterns, not the content of the traffic, just when it happens.
If two hosts are active at the same seconds repeatedly, that's a flag. If one becomes active a few seconds after another, that's also a flag (lateral movement).
Built as a POC. Requires tshark installed and network capture permissions.
pnpm install
# build core first
cd packages/core && pnpm run build
# run (needs sudo for network capture)
cd apps/cli && sudo pnpm run startEach IP gets a 60-second rolling binary window - 1 if it was active that second, 0 if not. Every 5 seconds the engine compares all active endpoints using cosine similarity, with phase shifting (+-5s) to catch delayed reactions between hosts.
- TypeScript monorepo, pnpm workspaces
packages/core- ring buffer + similarity mathapps/cli- tshark ingestion + detection engine