Built-in defensive replay
Jetson Edge Intrusion Detection
Jetson Edge Intrusion Detection
Defensive edge telemetry, lookback analytics, forecasting, and operator-reviewed IDS alerts for Jetson-class network nodes.
Evidence Summary
Operator-review evidence
GBM detector on 5k fixture
Measured inference run on jetsonthor (tegra264); CPUExecutionProvider
Current Working Analytics System
The current implementation uses fixed CSV telemetry as a deterministic fixture for lookback analytics, forecasting, operator-reviewed alerts, reports, and dashboard evidence.
Deterministic fixture for repeatable evidence
Feature windows and runtime metrics are generated
Training evidence records the forecaster gate
Alerts are emitted for operator review
Planned Jetson Telemetry-Ingestion Upgrade
Fixed CSV is the deterministic test fixture, not the product ceiling. The planned upgrade adds Jetson-generated flow CSVs from packet capture and defensive telemetry sources such as Zeek logs, Suricata eve.json, and CICFlow-style records.
| Item | Detail | Status |
|---|---|---|
| Current input | fixed CSV fixture | implemented |
| Next input | Jetson-generated flow CSV | planned |
| Capture modes | SPAN / TAP / local interface | planned |
| Flow extraction | Zeek conn.log, Suricata eve.json, CICFlow-style records | planned |
| Pipeline impact | No detector/dashboard rewrite required | design boundary |
| Thor benchmark | measured inference run | claimed for inference only |
Why This Exists
Edge nodes, robotics cells, private-network sites, and AI-enabled systems need local defensive telemetry review. This project does not replace a SIEM or claim a production IDS. It shows how local flow-style signals can become observable, forecastable, reviewable, and benchmarkable near the edge.
What I Built
I built a defensive edge telemetry runtime that normalizes events, extracts sliding-window features, runs conservative detection, emits alerts, stores evidence artifacts, and preserves a Jetson deployment path.
TrafficSource API
TelemetryEvent schema
fixed CSV fixture
planned flow ingestion
GBM detector artifact
AR forecaster artifact
FastAPI + web dashboard
Visual Evidence Links
Operator dashboard
Static evidence dashboard with runtime, model, and Thor-readiness summaries.
Replay report
Defensive replay summary with events, windows, alerts, and safety boundary.
Technical brief
Architecture principle, current pipeline, planned source adapters, and boundaries.
Business case
Why local defensive telemetry matters near edge nodes and robotics cells.
Training metrics
Committed detector and forecaster metrics, ONNX paths, gates, and CPU latency.
Thor benchmark
Measured hardware benchmark: latency tiers, throughput, memory, tegrastats rails and gate results.
Evidence vs Boundary
Evidence demonstrated
- Defensive replay path
- Normalized telemetry events
- Sliding-window feature extraction
- Alert JSONL and runtime metrics
- Reference detector and forecaster artifacts
- Jetson AGX Thor-class deployment runbook
Boundary preserved
- No offensive malware generation
- No exploit replay or offensive tooling
- No autonomous response action
- No live production IDS deployment claim
- No line-rate capture claim
- Thor latency is measured for inference only; capture and flow extraction remain unmeasured