Jetson Edge Intrusion Detection
Technical Brief
Current CSV-driven analytics, planned Jetson flow ingestion, stable event contracts, and defensive boundaries.
Technical Brief
Jetson Edge Intrusion Detection is built around one architecture rule: adapters may change, but the analytics pipeline should not. The current implementation validates the lookback, forecasting, alert, and reporting layers with fixed CSV telemetry as a deterministic fixture.
Current vs Planned Pipeline
| Layer | Current working system | Planned Jetson ingestion upgrade |
|---|---|---|
| Input source | Fixed CSV fixture | Jetson-generated flow CSV |
| Capture mode | Deterministic replay | SPAN, TAP, or local interface capture |
| Packet stage | Not required for current evidence | Rotating PCAP files |
| Flow extraction | CSV columns normalized into TelemetryEvent | Zeek conn.log, Suricata eve.json, CICFlow-style records |
| Analytics path | Lookback analytics, forecasting, alerts, reports | Same existing analytics path |
| Dashboard impact | Implemented | No detector/dashboard rewrite intended |
| Thor benchmark | Measured run committed | Measured inference run on jetsonthor (tegra264); CPUExecutionProvider |
Architecture Principle
Adapters may change. The analytics pipeline should not.
The planned upgrade adds a Jetson packet/flow ingestion stage before the existing CSV contract. New sources should normalize into the same event/schema boundary so the detector, lookback, forecasting, alerting, and dashboard layers remain stable.
Adapter Status
| Adapter | Status | Purpose |
|---|---|---|
| CsvTrafficSource | Implemented / current fixture | Reads fixed CSV telemetry and emits normalized events. |
| ZeekConnLogSource | Planned | Normalize Zeek conn.log records into the event contract. |
| SuricataEveJsonSource | Planned | Normalize Suricata eve.json flow and alert records. |
| CicFlowCsvSource | Planned | Normalize CICFlow-style records. |
| PcapFlowSource / PcapCaptureStage | Planned | Capture or replay packets, rotate PCAP files, and feed defensive flow extraction. |
Boundary
- Defensive telemetry only.
- No malware generation, exploit replay, or offensive tooling.
- No autonomous response.
- No production IDS deployment claim.
- No line-rate capture claim until packet drops, throughput, storage write rate, and flow extraction performance are measured.