mirror of
https://github.com/DaLaw2/NetGuardia.git
synced 2026-08-24 14:10:28 +09:00
DaLaw2
6794a8ca51
- Lead with one-line positioning (inline NIDS+IPS on eBPF, fused 4 detectors, SOAR, WORM audit) + tech stack block. Drop the sales pitch and aspirational SOC-persona framing — this is a personal project. - Replace the original 4 screenshots with an 18-tile grid covering the full UI surface (monitoring, security, system), placed under .github/images/ui/. - Add an SVG+PNG architecture diagram (.github/images/architecture.*) showing the three-band structure: control plane → user space (detectors → orchestrator → SOAR) → kernel-space XDP pipeline, with legend for the five arrow semantics. - Keep the AF_XDP NIC/kernel matrix; collapse getting-started to a three-line build block; point deeper architecture details to docs/. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
NetGuardia
Inline network security platform built on eBPF/XDP. Runs four independent detectors (per-packet ML, temporal beaconing, graph correlation, Suricata) over the same data plane, fuses their verdicts, drives SOAR playbooks, and writes every decision into a WORM audit chain.
Stack
- Data plane — eBPF / XDP / AF_XDP (aya, xsk-rs)
- Detection — Rust + tract-onnx for ML, custom temporal / graph engines, Suricata
eve.jsoningest - Control plane — actix-web REST + WebSocket, SQLite + SQLCipher, argon2 / JWT / CSRF, per-playbook SOAR
- Frontend — Vue 3 + Pinia + Vue-i18n (en / zh-TW / zh-CN / ja)
- Architecture — hexagonal:
adapter/·core/·infrastructure/·interface/·model/
Screens
 Traffic statistics (per-IP bytes/packets) |
 Live geographic flow map |
 Real-time drop monitor |
 Fused threat detection + ML status |
 IPv4/IPv6 allow + block lists |
 GeoIP country block |
 DNS blacklist |
 Per-class DDoS rate limits |
 HTTP / SSH service rules |
 SOAR playbooks + dry-run |
 Security report (PDF / email) |
 WORM-chained audit log |
 Users + groups + RBAC |
 API keys |
 Rotated flow recording |
 Live + archived logs |
 CPU / memory / NIC counters |
 Mode / theme / HTTP / engine |
Architecture
Requirements
Linux kernel with eBPF and a NIC driver that implements AF_XDP on that kernel. No single "minimum kernel" — it depends on the NIC.
| Driver | NIC family | Min kernel for AF_XDP |
|---|---|---|
mlx5 |
Mellanox ConnectX-4/5/6/7 | 5.x |
ixgbe |
Intel 82599, X520, X540, X550 | 5.x |
i40e |
Intel X710, XL710, XXV710 | 5.x |
ice |
Intel E810 | 5.5+ |
igb |
Intel i350 T2 (reference HW) | 6.17 |
igc |
Intel I225/I226 | 6.x |
virtio_net |
QEMU/KVM | varies |
Check with ethtool -i <iface> before deploying. 8 GB RAM minimum, 16 GB+ for high-traffic.
Build
cargo build --release --package net-guardia
sudo ./target/release/net-guardia
# open http://<host>:8080 — setup wizard issues the admin password on first boot
Systemd unit: deploy/netguardia.service.