Cybersecurity · K-Sensor Fusion Platform

IDS-X — Intrusion Detection

Operational · Actively Expanding

IDS-X is a next-generation, extensible intrusion detection and risk-sensing system that merges machine learning, statistical anomaly detection, and signature-based alerts into a unified, Bayesian-weighted framework. It combines diverse evidence streams — ML classification, Suricata signatures, and Zeek behavioral signals — into a single Weight-of-Evidence (WoE) fused score for every network flow.

Request a Briefing Download Executive Brief (PDF) ↓

System Concept

How K-Sensor Fusion Works

IDS-X evaluates every captured flow using a set of independent sensors. Each sensor contributes a deciban-based Weight-of-Evidence toward maliciousness. The K-sensor fusion model allows new sensors to be added without disrupting components already in production.

Sensor 1 · Machine Learning

UNSW ML Classifier

Base attack-probability model trained on the UNSW feature set, contributing a WoE range of −20 to +60 dB per flow.

Sensor 2 · Signature-Based

Suricata Signature Alerts

Correlates known-malicious signatures against the same traffic, applying +20 dB evidence bumps on confirmed hits.

Sensor 3 · Behavioral

Zeek Host Anomaly Score

Host-based behavioral anomaly detection, contributing 0 to +40 dB with flow-type fallback when data is sparse.

fused_woe = Σ sensor woe_dB

K-Sensor Weight-of-Evidence Fusion · has_any_k_sensor = OR(all sensor has_signal)

Worked Examples

Fusion in Action

Independent sensors frequently disagree. The fusion engine is what lets a strong signal from one sensor overcome a weak or negative read from another — without any single sensor acting as a bottleneck.

Flow A · HTTPS Outbound

ML WoE +59.2 dB · Suricata: no alert · Zeek: 0 dB

Fused: +59.2 dB

Flow B · Suspicious DNS

ML WoE −12.3 dB · Suricata: no alert · Zeek: +28 dB (abnormal outbound pattern)

Fused: +15.7 dB — overcomes ML negative

Flow C · Signature-Tagged

ML WoE −4.2 dB · Suricata: +20 dB (known-malicious IP) · Zeek: 0 dB

Fused: +15.8 dB

Optional Layer

GPT-Assisted Analyst Review

An optional GPT-reasoning layer reviews fused triage output and identifies rare destination IPs, high-WoE sensor disagreements, and host behavioral anomaly clusters — then produces an analyst narrative with recommended follow-up actions. GPT sits downstream of fusion as a review aid, not as a decision-maker in the detection loop.

Executive Brief

Why It Matters

Faster Detection

Reduces Mean Time to Detect by surfacing true anomalies faster across independent evidence streams.

Faster Response

Lowers Mean Time to Respond via GPT-assisted triage and automated event summarization.

Explainable by Design

Every fused score decomposes back into its per-sensor Weight-of-Evidence components — essential for audits and executive decisions.

Incremental Deployment

Layers onto existing SIEM/IDS investments; no rip-and-replace required to start realizing value.

Reference Architecture

Enterprise-Scale Design

IDS-X scales from single-site pilots to global, multi-site deployments, leveraging k-sensor modularity to integrate new data sources without architectural changes.

1 · Ingestion

Multiple regional sensors (Zeek, Suricata, Sysmon, DNS, cloud logs) aggregated securely via Kafka/Event Hubs or Beats/Fluentd.

2 · Storage & Indexing

Centralized SIEM/data lake (Elastic, Splunk, Sentinel) with long-term storage in S3, ADLS, or GCS.

3 · Fusion Layer

Scalable microservice performing k-sensor fusion and Weight-of-Evidence scoring across sources, with high-availability clustering.

4 · Analytics & AI

GPT-driven investigation assistant, cross-site correlation, and playbook generation.

5 · SOC User Interface

Dashboards, triage panels, and risk heatmaps, integrated with SOAR for semi-automated response.

Current State

Vulnerability Coverage

Detection strength by threat class under the current four-sensor deployment (Sysmon, Zeek, Suricata, ML).

Threat Class	Detection Strength	Sensors
Ransomware	Strong	Sysmon, Suricata, Zeek, ML
Credential Stuffing	Strong	Zeek, Suricata
DDoS	Strong	Zeek, Suricata
Privilege Escalation	Strong	Sysmon, Zeek
Lateral Movement	Very Strong	Sysmon, Zeek
Data Exfiltration	Strong	All sensors
Phishing	Partial	Sysmon, Zeek, Suricata
BEC	Partial	Sysmon, Zeek
Unpatched CVEs	Partial	Suricata, Sysmon
Cloud Misconfiguration	Partial	Zeek, ML
Insider Error	Partial	Sysmon, Zeek
Public Buckets	Partial	Zeek
Shadow IT	Partial	Zeek, ML
Weak Passwords	None	IAM required
No MFA	None	IAM required
Backup Failures	None	DR tooling required
Third-Party Outage	None	Ops monitoring required

Section 10 · Strategic Sensor Expansion

90-Day Expansion Roadmap

A roadmap to convert the yellow/red areas above into green — without adding SIEM complexity or destabilizing the sensors already in production.

High Value · Low Risk

M365 / Workspace Security Logs

Adds coverage for phishing, BEC, and MFA gaps.

Very High Value · Very Low Risk

Cloud Posture Snapshots

AWS/Azure/GCP posture checks add coverage for misconfigurations and public bucket exposure.

High Value · Low Risk

Identity Telemetry

Lightweight AD/SAML/OAuth sampling detects credential attacks, Kerberoasting, and privilege escalation.

Moderate Value · Very Low Risk

DNS Resolver Logs

Adds detection for C2 traffic, DGAs, phishing callbacks, and DNS hijacking.

High Value · Moderate Risk

Lightweight EDR Expansion

Extends coverage for ransomware, insider misuse, and lateral movement.

Phase A · Weeks 1–2

Add DNS telemetry, M365 logs, and an AD/SAML sampler.

Phase B · Weeks 3–6

Add cloud posture snapshots and OAuth visibility.

Phase C · Weeks 7–12

Add Sysmon endpoints, lightweight EDR, and an ML model extension.

Deliberately Excluded

To preserve safety and stability, the roadmap avoids full SIEM ingestion, CASB/SASE, full EDR suites with kernel drivers, vulnerability scanners, and inline proxies. Every new sensor integrates into the existing WoE fusion pipeline while preserving Jeffreys interpretation, clamped ranges, and daily time-series history.

Resources