Observe first. Enforce later.
The manual’s core advice is also our process: never switch on automatic blocking before you have watched dry-run results on your own traffic.
Eight steps
Environment & requirements review
Confirm OS (Linux recommended), Python 3.10+, memory / disk, network capture points and who may run with root / CAP_NET_RAW / CAP_NET_ADMIN. Confirm written authorization to monitor.
Installation & self-check
Create a virtual environment, install dependencies (PyTorch CPU wheel), then run the checks.
python main.py --version && python main.py defend self-testBaseline data collection
Collect normal traffic (for example 1–7 working days of pcap) and attack-free logs — only on networks you manage.
sudo tcpdump -i eth0 -w normal_%Y%m%d_%H.pcap -G 3600 -C 1000 -Z $USER 'ip'Training & measurement
Train unsupervised baselines (Isolation Forest, Autoencoder), HIDS and, if needed, supervised models; measure precision, recall and false-positive rate on your data.
python main.py nids train --dataset pcap --pcap normal.pcap --feature-set extendedDry-run observation (several days)
Run the defense engine without enforcement; review the dashboard and reports for would-be blocks that hit legitimate traffic or admins.
sudo .venv/bin/python main.py defend run --iface eth0 --authlog /var/log/auth.log --conn --watch ~/DownloadsAllowlist & threshold tuning
Add your admin IPs and critical ranges to
allowlist.cidrs; adjust detector thresholds, BPF filter,min_votes; retrain the baseline if needed.Staged enforcement
Set
defense.enforcement.allow: true, start on a test server with--enforce --rollback-on-exit, keep console access, then widen scope.defend rollbackreverts everything.Operation & review
Daily / weekly reports,
verify-audit, log rotation and retention, off-box audit backups, periodic baseline retraining and rule updates.
Who needs which privileges
| Task | Privilege | Example |
|---|---|---|
| Watch files / logs / pcap, record only (dry-run) | Normal user | python main.py defend run --authlog /var/log/auth.log --watch ~/Downloads |
| Watch /proc/net/tcp connections | Normal user (Linux) | python main.py defend run --conn |
| Live packet sniffing | root or CAP_NET_RAW | sudo .venv/bin/python main.py defend run --iface eth0 |
| Real IP blocking | root or CAP_NET_ADMIN | … defend run --iface eth0 --enforce + allow: true |
| UI / reports | Normal user | python main.py ui · python main.py report |
setcap on a Python interpreter lets every script run by it open raw sockets — apply it only to a dedicated virtual environment, and prefer sudo on shared servers.
Talk to us about your environment
Tell us about your network, hosts and constraints. We will propose a dry-run-first pilot plan — no obligation.