Vigilo

Detect Compromised Devices Before They Become Breaches

Vigilo learns what "normal" looks like for every device on your network from Zeek connection metadata (conn.log) — who talked to whom, when, and how much. When a device starts scanning ports, beaconing to a C2 server, or participating in a flood, Vigilo flags it without signatures, without cloud dependencies, and without sending traffic off your network. Payload contents (e.g. HTTPS bodies) are not inspected.

Status: v0.1.0 research prototype — IoT-23 lab benchmarks are documented; field validation on home/enterprise networks is ongoing.

75% Detection rate @ 1% FPR

~1.3M Parameters (runs on CPU)

20 Malware families tested

0 Data sent to cloud

How Vigilo Works

Ingest

Vigilo reads Zeek conn.log files or converts pcap captures via tshark/Zeek. Works with passive taps (switch SPAN/mirror), gateway Zeek (pfSense/OPNsense), or lab MITM capture scripts.

Featurize

Traffic is grouped into 5-minute behavioral windows per device. Each window captures 15 features: connection counts, byte volumes, port distributions, protocol ratios, and timing patterns.

Forecast

A ~1.3M parameter Mamba-2 state-space model predicts the next behavioral window based on the device's history. The model is trained only on benign traffic — it learns "normal."

Score

Anomaly is measured as forecast error. If the device's actual behavior is far from what the model predicted, the surprise score is high — indicating abnormal behavior.

Ensemble

A dedicated beaconing detector identifies stealthy periodic C2 channels that volume-based detection might miss. Results from both detectors are combined for the final verdict.

Benchmark Results — IoT-23 Dataset

Trained on benign honeypot captures (29 benign devices). Evaluated on every malware family in IoT-23 including Mirai, Okiru, Torii, Gagfyt, Hajime, and Kenjiro. IoT-23 is lab data — not yet validated on live home or enterprise networks.

Detection Performance

Metric	Value
Detection @ ~1% FPR	75% (15/20 infected devices)
Benign baseline (device peak)	p95 = 1.93, max = 1.97
Training data	Benign traffic only, 29 devices
Model size	~1.3M params, CPU, fully local

What It Catches

All loud attacks — port scans, DDoS/flooding, noisy botnet C&C. These score far above the benign ceiling:

Anomaly scores of 1444, 65, 5.3 (vs. benign max 1.97)
Mirai variants, Okiru, Gagfyt flooding detected immediately
Port scanning activity flagged with high confidence

Honest Limitations

5 of 20 infected devices were missed — all stealthy, low-volume C&C:

One capture: only 16 malicious flows among 3,193 benign
These sit right at the benign ceiling threshold
Per-device baselining and flow-level inspection are on the roadmap

Data Experiment Findings

Run-to-run variance: Same setup gave 75% @ 1% FPR one run, 40% @ 1% / 75% @ 5% another. Loud attacks always caught, stealthy always missed — threshold calibration is the variable.
PC traffic hurts: Adding general-host captures dropped detection 75% → 20%. PCs are too noisy; train on IoT-like traffic only.
Implication: Per-asset baselining is the path to "works with any device" and stable thresholds.

Technical Architecture

Mamba-2 SSM Core

The forecaster uses a Mamba-2 Structured State Space model — O(1) memory per step, hardware-optimized scan, ideal for streaming time-series data on resource-constrained devices.

Zeek / pcap Ingestion

Native Zeek conn.log parsing with automatic pcap-to-conn.log conversion via tshark. Works with existing network taps and monitoring infrastructure.

15-Feature Behavioral Windows

Each 5-minute window captures connection counts, byte volumes, port entropy, protocol distribution, and timing patterns per device.

Beaconing Detector

Measures inter-connection interval regularity (coefficient of variation) to detect periodic C2 beaconing — stealthy callback patterns that volume-based detection may miss.

Flask Dashboard

Local web UI with per-device verdicts and scores. JSON API at /api/results for integration; refresh re-analyzes the configured log file.

Docker Deployment

One-command deployment via Docker Compose. Configurable via environment variables for log paths, checkpoints, worker counts, and bind addresses.

Deployment

Recommended production path: passive capture via switch SPAN/mirror or gateway Zeek. Optional Bettercap MITM scripts exist for lab testing on networks you own (disruptive; not recommended for production). Full wiring guide: SPAN / gateway deployment docs on GitHub.

Demo (no hardware)

                        pip install -e .

                        python scripts/generate_demo_data.py

                        vigilo serve

                        # http://127.0.0.1:8088

Passive SPAN / mirror

                        cp .env.span.example .env

                        # CAPTURE_IFACE=eth1  (mirror NIC)

                        docker compose --profile span up -d

Step-by-step SPAN guide →

Docker (analyze existing logs)

                        cp .env.example .env

                        make build && make up

                        # Dashboard at http://127.0.0.1:8088

Train on your network

                        vigilo train --logs data/benign.conn.log \

                          --output-dir checkpoints/vigilo

                        vigilo detect --log suspect.conn.log \

                          --ckpt checkpoints/vigilo/vigilo.pt

Configuration

Variable	Default	Description
`VIGILO_LOG`	`data/demo/sample.conn.log`	Path to the conn.log to analyze
`VIGILO_CKPT`	`checkpoints/demo/vigilo.pt`	Trained model checkpoint
`VIGILO_HOST`	`0.0.0.0`	Dashboard bind address
`VIGILO_PORT`	`8088`	Dashboard port
`VIGILO_WORKERS`	`2`	Gunicorn worker count
`VIGILO_TIMEOUT`	`120`	Request timeout (seconds)