See everything.
Miss nothing.

ASIC punts only suspicious traffic to the CPU. DPDK bypasses the OS kernel on Linux x86 — packets flow directly from NIC hardware queues to IDS memory without a copy. CPU affinity isolates IDS cores from UI and log workloads.

A lock-free SPSC ring buffer using C11 atomics sits between the capture thread and the IDS engine. The engine never waits on downstream consumers. Live metrics are exposed via shared memory — the dashboard reads at zero overhead.

Shannon entropy computed over the 5-tuple source distribution in a sliding window classifies traffic as flood vs suspect before it touches the IDS queue. An attacker cannot trigger degradation mode by flooding — the flood never enters the IDS budget.

A per-packet lightweight classifier (XGBoost → ONNX Runtime, or auto-generated C decision tree on MIPS) drops obviously malicious traffic before deep inspection. Shadow mode logs drops without executing them during a burn-in window — real drops only activate when the FP rate is verified below threshold.

Every layer above this sees a single canonical, unambiguous byte stream. IPv4 defragmentation, TCP reassembly, IPv6 extension header parsing, QUIC/HTTP3/MASQUE stream reassembly, and slow-drip multi-window rate analysis are all applied before any inspection occurs.

Bidirectional sessions are reconstructed from normalised stream segments using a cuckoo hash table with O(1) worst-case lookup. Explicit per-flow TTLs and a hard memory cap prevent unbounded state growth regardless of attacker-controlled traffic.

JA4 TLS fingerprinting (replaces JA3S; ECH-resistant) combined with HTTP header characteristics and TCP/IP stack identity produces a composite multi-signal pseudo-identity without endpoint access. Identity is a weighted score, not a single spoofable hash.

Session-level timing, volume, and destination attributes are extracted from metadata alone — no payload inspection, no decryption. LYNX works equally on plaintext and fully encrypted traffic, deriving all detection signals from observable behaviour.

A multi-stage attack modeler detects recon → access → enumeration → escalation → exfiltration chains even when individual sessions appear legitimate. A configurable correlation window (1 hour – 7 days) links activity across time. A baseline poison detector flags gradual adversarial drift.

Normalization anomalies, fingerprint deviations, and behavioral outliers are fused into a single context-aware risk score. An uncertainty gate routes verdicts: suppress (clear FP), escalate to TinyLlama (uncertain), or alert the SOC directly (confirmed threat).

A fine-tuned TinyLlama-1.1B model runs as an async worker off the hot path. It receives a wire-only flow graph as structured text and returns a binary verdict: THREAT or FALSE_POSITIVE. Uncertain verdicts go to the analyst — never silently suppressed.

Enriched alerts stream as JSON Lines to stdout, syslog, and a WebSocket dashboard. The React 18 dashboard uses virtual scrolling for 100k+ alert rows, OffscreenCanvas charts, alert grouping, and a permanent health indicator showing degradation level, CPU, and queue depth.