Upload folder using huggingface_hub
Browse files
README.md
CHANGED
|
@@ -19,7 +19,11 @@ pipeline_tag: other
|
|
| 19 |
|
| 20 |
# C2Sentinel
|
| 21 |
|
| 22 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
| 23 |
|
| 24 |
**Author:** Daniel Ostrow
|
| 25 |
**Website:** [neuralintellect.com](https://neuralintellect.com)
|
|
@@ -27,6 +31,15 @@ A machine learning model for detecting Command and Control (C2) beacon communica
|
|
| 27 |
|
| 28 |
---
|
| 29 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 30 |
## Overview
|
| 31 |
|
| 32 |
C2Sentinel analyzes network connection patterns to identify C2 beacon activity. The model uses behavioral analysis rather than port-based filtering, enabling detection of C2 communications on any port. This approach catches C2 activity regardless of whether attackers use expected ports (4444) or attempt to blend in on common ports (443, 80, 53).
|
|
|
|
| 19 |
|
| 20 |
# C2Sentinel
|
| 21 |
|
| 22 |
+
[](https://huggingface.co/danielostrow/c2sentinel)
|
| 23 |
+
[](https://opensource.org/licenses/MIT)
|
| 24 |
+
[](https://huggingface.co/spaces/danielostrow/c2sentinel)
|
| 25 |
+
|
| 26 |
+
A machine learning model for detecting Command and Control (C2) beacon communications in network traffic. Built on a fine-tuned [LogBERT](https://arxiv.org/abs/2103.04475) transformer architecture.
|
| 27 |
|
| 28 |
**Author:** Daniel Ostrow
|
| 29 |
**Website:** [neuralintellect.com](https://neuralintellect.com)
|
|
|
|
| 31 |
|
| 32 |
---
|
| 33 |
|
| 34 |
+
## Base Model
|
| 35 |
+
|
| 36 |
+
This model is fine-tuned from the LogBERT architecture for log anomaly detection.
|
| 37 |
+
|
| 38 |
+
- **Paper:** [LogBERT: Log Anomaly Detection via BERT](https://arxiv.org/abs/2103.04475) (Guo, Yuan, Wu - IJCNN 2021)
|
| 39 |
+
- **Original Implementation:** [github.com/HelenGuohx/logbert](https://github.com/HelenGuohx/logbert)
|
| 40 |
+
|
| 41 |
+
---
|
| 42 |
+
|
| 43 |
## Overview
|
| 44 |
|
| 45 |
C2Sentinel analyzes network connection patterns to identify C2 beacon activity. The model uses behavioral analysis rather than port-based filtering, enabling detection of C2 communications on any port. This approach catches C2 activity regardless of whether attackers use expected ports (4444) or attempt to blend in on common ports (443, 80, 53).
|