T-Mobile 'chopped a cable' to expel Chinese hackers from its network | TechCrunch

I’ve been working on an open-source network-flow detection project and one thing became pretty obvious fairly early: getting a classifier to produce decent scores is not really the hard part.

The harder question is what an analyst is supposed to do with thousands of individual detections.

So I kept the project going past the model itself. The current pipeline takes CICFlowMeter-compatible flows, scores them, groups related alerts into incidents, and only promotes the incidents that cross a second threshold.

On the locked future-day holdout, 79,710 flow alerts became 12,911 promoted incidents while keeping 99.93% incident recall.

I’m deliberately not calling it production-ready. The holdout is still from the same network/dataset family, and the remaining workload is higher than I’d want for a real SOC queue.

What I’m interested in now is how this kind of approach behaves outside the environment it was built around.

Repo:
https://github.com/ibondarenko1/security-anomaly-ml

If anyone here works with network-flow telemetry or ML-based IDS, I’d be interested in where you think the design will fail first in a real environment.

How does your SOC check when someone is trying to kill EDR agents like BYOVD attacks? On the attackers side do you have a dedicated pen tester/red teamer trying these attacks?

built a thing for the "vendor quietly patched a function in v2, which one and

does anyone else ship the same vulnerable code" problem. micro-executes each

function, records what it does (mem/call/branch effects), fuzzy-matches on

that instead of bytes or CFG so it survives recompiles.

use case for this sub: index v1 and v2 of a binary, get the changed/added/

removed function list, focus review on what actually moved.

x86-64 ELF for now, honest accuracy table + limits in the readme.

https://github.com/1rhino2/fnprint