Posts tagged detection.
What syscall-layer tooling cannot see in P2P infrastructure: a technique-by-technique analysis
If you run Falco, an EDR, or a generic host agent on a validator and a network-DoS attack against the node went undetected, this explains why. A technique-by-technique analysis of five reproduced P2P-infrastructure attacks against the syscall detection surface. Zero are detectable as attributable rules, and the reasons are structural, not a matter of tuning.
The 99% was wrong. So was the 0.32.
Our detector's 99% accuracy was memorisation, and the 0.32 we nearly published in its place was wrong too. The clean experiment found the real split: cross-chain detection generalises, attribution doesn't.
How we decide a finding is real before we tell you about it
We had a clean denial-of-service against consensus. Re-verification said the baseline was that low by config. No attack. So we pulled it. The discipline that catches our own mistakes is the reason our advisories are worth reading.
How we're building cross-chain ML detection for blockchain validator infrastructure
How we built a wire-shape detector that transfers across chains. V8 trained only on Sui hit 51 out of 51 zero-shot on Solana attacks it had never seen, because mechanism-class features carry across chains while host-telemetry features don't.