Deterministic fixture for repeatable evidence
Jetson Edge Intrusion Detection
Jetson Edge Intrusion Detection Dashboard
Defensive edge telemetry, lookback analytics, forecasting, and operator-reviewed IDS alerts for Jetson-class network nodes.
Operational Decision Summary
delta AUC threshold reported in training_run.json
MAE reduction threshold reported in training_run.json
Measured inference run on jetsonthor (tegra264); CPUExecutionProvider
Current Working System
The dashboard separates implemented CSV-driven analytics from planned Jetson flow ingestion. Completed metrics below come from the current fixed CSV fixture path.
| Capability | Status | Evidence |
|---|---|---|
| Input source | fixed_csv | Deterministic fixture for replay and reporting |
| Lookback analysis | implemented | 8 feature windows |
| Forecasting | implemented | Forecaster gate PASS |
| Alerts | implemented | 4 alerts emitted |
| Dashboard / reporting | implemented | Static GitHub Pages-compatible evidence pack |
Planned Jetson Ingestion Upgrade
Planned work is not counted as completed evidence. The next input is Jetson-generated flow CSV from defensive packet/flow sources, then the same analytics pipeline continues unchanged.
| Item | Detail | Status |
|---|---|---|
| Current input | fixed CSV fixture | implemented |
| Next input | Jetson-generated flow CSV | planned |
| Capture modes | SPAN / TAP / local interface | planned |
| Flow extraction | Zeek conn.log, Suricata eve.json, CICFlow-style records | planned |
| Pipeline impact | No detector/dashboard rewrite required | design boundary |
| Thor benchmark | measured inference run | claimed for inference only |
Problem -> What I Built -> What I Found -> What I Would Validate Next
Problem
Edge IDS telemetry arrives from heterogeneous defensive sources, but operator workflows need one normalized evidence path.
What I Built
A source-agnostic runtime that converts defensive telemetry into events, windows, detections, alerts, metrics, and evidence artifacts.
What I Found
The committed demo emits 4 alerts from 8 feature windows, and model gates are recorded in training evidence.
What I Would Validate Next
Generate Jetson flow CSV from defensive captures, measure packet drops and flow extraction on the same device, evaluate the detector on a public benchmark dataset, and keep all response actions operator-reviewed.
Runtime Evidence
| Metric | Value | Source |
|---|---|---|
| Events seen | 12 | reports/demo/runtime_metrics.json |
| Feature windows | 8 | reports/demo/runtime_metrics.json |
| Detections seen | 4 | reports/demo/runtime_metrics.json |
| Alerts emitted | 4 | reports/demo/runtime_metrics.json |
| Rows skipped | 0 | reports/demo/runtime_metrics.json |
Alert Severity Distribution
| Severity | Count |
|---|---|
| high | 2 |
| medium | 2 |
Model Evidence
| Layer | Evidence | Status |
|---|---|---|
| Detector | GBM AUC 0.9796 vs IsolationForest AUC 0.6433 | PASS |
| Forecaster | Ridge MAE 7.492 vs lag baseline 10.24 | PASS |
| ONNX exports | models/exports/gbm_detector.onnx and models/exports/ar_forecaster.onnx | exported |
Jetson / Thor Readiness
Values below come from a committed run of deploy/thor/run_benchmark.py on the named device. They cover model inference only; packet capture and flow extraction are not measured.
| Gate | Threshold | Measured | Status |
|---|---|---|---|
| Detector p95 latency | <= 10 ms | 0.0237 ms | pass |
| Forecaster p95 latency | <= 50 ms | 0.0141 ms | pass |
| Throughput at 1000 events/s | >= 1000 ev/s | 1000 events/s | pass |
| Memory footprint | <= 4 GB | 0.3639 GB | pass |
Thor Measurement
Device: jetsonthor (tegra264). L4T: # R38 (release), REVISION: 4.0, GCID: 43443517, BOARD: generic, EABI: aarch64, DATE: Wed Dec 31 00:15:19 UTC 2025. Power mode: NV Power Mode: 120W 1. onnxruntime 1.29.0, Python 3.12.3. Run 3cac5ed2b7bd, 300 s per tier.
| Model | Provider | Target ev/s | Achieved ev/s | p50 / p95 / p99 ms | VIN p50 / peak mW | tj peak C |
|---|---|---|---|---|---|---|
| detector | CPUExecutionProvider | 1000.0 | 1000.0 | 0.0213 / 0.0237 / 0.028 | 54298 / 56054 | 59.562 |
| forecaster | CPUExecutionProvider | 1000.0 | 1000.0 | 0.0138 / 0.0141 / 0.0143 | 24424 / 26194 | 40.687 |
Idle VIN before load: 24170 mW. Process peak RSS: 0.3639 GB. Inputs are synthetic Gaussian tensors of the model input shapes; this measures inference latency and throughput only, not packet capture or flow extraction.
Execution provider fallbacks recorded in the artifact:
- detector: Fail: [ONNXRuntimeError] : 1 : FAIL : Non-zero status code returned while running Slice node. Name:'' Status Message: CUDA error cudaErrorNoKernelImageForDevice
- forecaster: Fail: [ONNXRuntimeError] : 1 : FAIL : Non-zero status code returned while running Slice node. Name:'' Status Message: CUDA error cudaErrorNoKernelImageForDevice
Thread Pool Comparison
Two matched runs on the same device differing only in onnxruntime session options. Baseline run 1e430379de9b uses runtime defaults; variant run 42314e8252e9 uses one intra-op thread, one inter-op thread and no spin waiting. Values are baseline / variant; delta is variant minus baseline. Source: reports/thor_benchmark_threads.json.
| Model | Target ev/s | VIN p50 mW | VIN delta mW | Pacing misses | p95 ms | tj peak C |
|---|---|---|---|---|---|---|
| detector | 100 | 53384 / 24352 | -29032 | 0 / 0 | 0.0587 / 0.0273 | 53.75 / 41.03 |
| detector | 1000 | 54102 / 24312 | -29790 | 16944 / 0 | 0.0238 / 0.0219 | 56.56 / 40.38 |
| forecaster | 100 | 24424 / 24200 | -224 | 0 / 0 | 0.0373 / 0.0407 | 48.88 / 40.06 |
| forecaster | 1000 | 24348 / 24172 | -176 | 3 / 5 | 0.0365 / 0.0367 | 42.66 / 39.81 |
Cross-device inference comparison
Recorded 1000 events/s tier, per model. The RTX host runs are CPU-only and are not pooled with Thor results. Sources: reports/thor_benchmark.json and reports/bench/*.json.
| Device/run | Model | p50 / p95 / p99 (ms) | Achieved events/s | Misses | Peak RSS (GB) | Provider |
|---|---|---|---|---|---|---|
| AGX Thor | detector | 0.0213 / 0.0237 / 0.028 | 1000.0 | 43118 | 0.3558 | CPUExecutionProvider |
| AGX Thor | forecaster | 0.0138 / 0.0141 / 0.0143 | 1000.0 | 0 | 0.3639 | CPUExecutionProvider |
| RTX 5090 host | detector | 0.0387 / 0.0834 / 0.1102 | 1000.0 | 656 | 0.0693 | CPUExecutionProvider |
| RTX 5090 host | forecaster | 0.0354 / 0.0694 / 0.0831 | 1000.0 | 0 | 0.0702 | CPUExecutionProvider |
| RTX 5090 host, single/no-spin | detector | 0.0225 / 0.0338 / 0.0688 | 1000.0 | 0 | 0.0658 | CPUExecutionProvider |
| RTX 5090 host, single/no-spin | forecaster | 0.0397 / 0.0689 / 0.0966 | 1000.0 | 17 | 0.0692 | CPUExecutionProvider |
Evidence vs Boundary
Evidence demonstrated
- TrafficSource abstraction and normalized telemetry events
- Defensive replay metrics and alert artifacts
- Reference detector and forecaster training evidence
- FastAPI/web dashboard integration path
- Thor-class runbook and benchmark template
Boundary preserved
- No offensive tooling
- No malware generation
- No exploit replay
- No autonomous response action
- No live production IDS deployment claim
- No line-rate capture claim