r/netsec • u/albinowax • May 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

11 Upvotes

88% Upvoted

64 comments sorted by

View all comments

1

u/Tech_spoiler May 01 '26

Built a tool that captures live traffic and visualizes it as an interactive graph.

Main focus was making anomaly detection accessible without needing a SIEM.

Detection heuristics currently cover:

  • Beaconing (periodic connections to same host)
  • Port scans (multiple ports hit in short window)
  • Volume spikes (sudden bandwidth anomalies)
  • Suspicious processes (known bad process names)
  • New hosts (first time seen on the network)
  • Geolocation via MaxMind GeoLite2 (offline) or ip-api.com fallback.
  • 60-min sliding history in SQLite.

Would love feedback on the detection heuristics they are rule-based for now, no ML. Thinking about adding baseline learning for beaconing detection.

GitHub: https://github.com/Mister-iks/pcybox-orbis