Three Detection Paradigms. One Dataset. One Result.

Three Detection Paradigms. One Dataset. One Result. For the last 147 days I’ve been building aRGus, an open-source Network Detection & Response (NDR) pipeline focused on behavioral detection using machine learning and real packet telemetry. Today we completed something I personally wanted to see for a long time: A direct comparison between three radically different network security paradigms on the same dataset, same hardware, and same analysis conditions. Not “which tool is better”. But what each paradigm is actually capable of seeing. The Experiment We used the CTU-13 Neris botnet scenario from 2011. The malicious corpus contains: 646 malicious flows IRC beaconing HTTP anomalies SMB lateral movement classic botnet behavior patterns Three systems analyzed the same capture: System Paradigm Suricata Signature-based IDS Zeek Telemetry & anomaly observation aRGus Behavioral ML-based NDR Environment: Commodity hardware Same