NetGuardia

Inline network security platform built on eBPF/XDP. Combines ONNX-based ML, temporal beaconing, correlation heuristics, and Suricata eve.json alerts in one fusion path, drives SOAR playbooks, and writes decisions into a WORM audit chain.

Stack

• Data plane — eBPF / XDP / AF_XDP (aya, xsk-rs)
• Detection — Rust + tract-onnx for ML, custom temporal / graph engines, Suricata eve.json ingest
• Control plane — actix-web REST + WebSocket, SQLite + SQLCipher, argon2 / JWT / CSRF, per-playbook SOAR
• Frontend — Vue 3 + Pinia + Vue-i18n (en / zh-TW / zh-CN / ja)
• Architecture — hexagonal-ish Rust workspace: domain/ · interface/ · core/ · adapter/ · infrastructure/

Screens

Traffic statistics (per-IP bytes/packets)	Live geographic flow map	Real-time drop monitor
Fused threat detection + ML status	IPv4/IPv6 allow + block lists	GeoIP country block
DNS blacklist	Per-class DDoS rate limits	HTTP / SSH service rules
SOAR playbooks + dry-run	Security report (PDF / email)	WORM-chained audit log
Users + groups + RBAC	API keys	Rotated flow recording
Live + archived logs	CPU / memory / NIC counters	Mode / theme / HTTP / engine

Architecture

Requirements

Linux kernel with eBPF and a NIC driver that implements AF_XDP on that kernel. No single "minimum kernel" — it depends on the NIC.

Driver	NIC family	Min kernel for AF_XDP
mlx5	Mellanox ConnectX-4/5/6/7	5.x
ixgbe	Intel 82599, X520, X540, X550	5.x
i40e	Intel X710, XL710, XXV710	5.x
ice	Intel E810	5.5+
igb	Intel i350 T2 (reference HW)	6.17
igc	Intel I225/I226	6.x
virtio_net	QEMU/KVM	varies

Check with ethtool -i <iface> before deploying. 8 GB RAM minimum, 16 GB+ for high-traffic.

Build

cargo build --release --package net-guardia
sudo ./target/release/net-guardia
# open http://<host>:8080 — setup wizard issues the admin password on first boot

Systemd unit: deploy/netguardia.service.