Inline network security platform built on eBPF/XDP. Runs four independent detectors (per-packet ML, temporal beaconing, graph correlation, Suricata) over the same data plane, fuses their verdicts, drives SOAR playbooks, and writes every decision into a WORM audit chain.

Stack

Data plane — eBPF / XDP / AF_XDP (aya, xsk-rs)
Detection — Rust + tract-onnx for ML, custom temporal / graph engines, Suricata eve.json ingest
Control plane — actix-web REST + WebSocket, SQLite + SQLCipher, argon2 / JWT / CSRF, per-playbook SOAR
Frontend — Vue 3 + Pinia + Vue-i18n (en / zh-TW / zh-CN / ja)
Architecture — hexagonal: adapter/ · core/ · infrastructure/ · interface/ · model/

Screens

_{Traffic statistics (per-IP bytes/packets)}	_{Live geographic flow map}	_{Real-time drop monitor}
_{Fused threat detection + ML status}	_{IPv4/IPv6 allow + block lists}	_{GeoIP country block}
_{DNS blacklist}	_{Per-class DDoS rate limits}	_{HTTP / SSH service rules}
_{SOAR playbooks + dry-run}	_{Security report (PDF / email)}	_{WORM-chained audit log}
_{Users + groups + RBAC}	_{API keys}	_{Rotated flow recording}
_{Live + archived logs}	_{CPU / memory / NIC counters}	_{Mode / theme / HTTP / engine}

Architecture

Requirements

Linux kernel with eBPF and a NIC driver that implements AF_XDP on that kernel. No single "minimum kernel" — it depends on the NIC.

Driver	NIC family	Min kernel for AF_XDP
`mlx5`	Mellanox ConnectX-4/5/6/7	5.x
`ixgbe`	Intel 82599, X520, X540, X550	5.x
`i40e`	Intel X710, XL710, XXV710	5.x
`ice`	Intel E810	5.5+
`igb`	Intel i350 T2 (reference HW)	6.17
`igc`	Intel I225/I226	6.x
`virtio_net`	QEMU/KVM	varies

Check with ethtool -i <iface> before deploying. 8 GB RAM minimum, 16 GB+ for high-traffic.

Build

cargo build --release --package net-guardia
sudo ./target/release/net-guardia
# open http://<host>:8080 — setup wizard issues the admin password on first boot

Systemd unit: deploy/netguardia.service.