Anvex

Passive AI threat radar and immutable blockchain forensics for air-gapped networks.

Comment

Inspiration

Imagine a nuclear power plant, a missile defense grid, or a classified naval submarine. To guarantee physical safety and prevent data leaks, these highly secure installations use Optical Data Diodes—physical fiber-optic cables where light (and data) can only travel in one direction.

Here is the catastrophic problem: Traditional cybersecurity firewalls break completely in this environment. Standard Intrusion Detection Systems (IDS) rely on two-way TCP handshakes (SYN-ACK) to monitor connections. Because the data diode physically severs the return path, conventional tools go completely blind.

We realized that to protect air-gapped critical infrastructure, we couldn't rely on two-way communication or deep-packet decryption. We needed a system that acts like an ultra-smart, silent radar—capable of catching zero-day threats purely by observing the physics, timing, and mathematical behavior of network packets. That is how ANVEX was born.

What it does

ANVEX is an autonomous, AI-driven passive threat radar and immutable blockchain forensic ledger built specifically for unidirectional IP traffic (SIH PS 26145).

It operates entirely as a "Zero-Return" network sensor. When traffic pours out of the optical diode, ANVEX intercepts the raw packets and extracts 13 directional statistical metrics without ever decrypting the payload. It runs this telemetry through a Dual-Engine AI to classify 6 distinct attack vectors (like DDoS, Port Scans, and Botnet C2s) while simultaneously hunting for unknown Zero-Day anomalies.

If a threat is detected, the system calculates a canonical SHA-256 digest of the attack and permanently anchors it to a local EVM smart contract (ForensicAuditLedger.sol). Finally, it streams the alert—along with mathematical evidence—to a sub-25ms React 18 Mission Control SOC Dashboard.

How we built it

We engineered ANVEX as a high-speed, asynchronous streaming microservice architecture:

  • Ingestion (The Sensor): We used Python, Scapy, and Zeek parsers to passively sniff physical SPAN ports and .pcap files, extracting layer-3/layer-4 metrics like Inter-Arrival Time (IAT) variance and packet size distribution.
  • AI Engine (The Brain): We deployed a Dual-Engine AI Core:
    • Supervised: An XGBoost classifier for known threats, utilizing a Softmax probability objective.
    • Unsupervised: An Isolation Forest model to catch novel zero-day malware based purely on geometric isolation.
  • Web3 Ledger (The Vault): A local Hardhat EVM node interacts with our custom Solidity smart contract via JSON-RPC, ensuring mathematically tamper-proof chain-of-custody.
  • Backend & Frontend (The HUD): A FastAPI asynchronous server routes WebSocket streams to a sleek, dark-themed React 18 / Tailwind dashboard featuring interactive 3D elements powered by Framer Motion and Three.js.

Challenges we ran into

  1. The "No Black Box" Trust Issue: In real-world security operations, analysts refuse to shut down critical servers based on an AI's "guess." We had to prove exactly why the AI made a decision. We overcame this by integrating TreeSHAP (SHapley Additive exPlanations) directly into the inference pipeline, displaying the exact mathematical weight of every feature on the frontend.
  2. Encrypted Traffic Blindness: 95% of modern enterprise traffic is TLS/HTTPS encrypted. We couldn't read the payloads. We solved this by extracting JA3/JA4 cryptographic fingerprints and calculating Shannon Entropy, allowing the AI to detect malicious payloads strictly through behavioral physics.
  3. High-Speed Pipeline Latency: Processing raw packets, running two ML inferences, hashing to Ethereum, and updating the DOM takes time. Through strict asynchronous programming in FastAPI and WebSocket optimization, we pushed our end-to-end pipeline latency to under 25 milliseconds.

Accomplishments that we're proud of

  • High-Fidelity AI Accuracy: We trained our XGBoost model on a highly balanced 3,500-sample dataset, achieving 99.86% multi-class accuracy ( \(F_1 = 1.00\) ) against threats like DGA Fast-Flux and Data Exfiltration.
  • The Softmax Threat Separation: We successfully proved that the physical metrics of cyberattacks are so distinct that our Softmax probability function consistently outputs >90% confidence for true positives: $$P(\text{Class}i) = \frac{e^{z_i}}{\sum{j=1}^{K} e^{z_j}}$$
  • Judicial Admissibility: By bridging our AI layer with an immutable EVM blockchain, we created a system that directly complies with the NIST SP 800-86 framework for digital forensics, making our alert logs courtroom-ready.

What we learned

We learned the profound difference between standard machine learning and applied cybersecurity physics. We mastered how unsupervised algorithms like Isolation Forest don't need attack labels to find threats; they simply look for outliers based on path length isolation \(h(x)\): $$s(x, n) = 2^{-\frac{E(h(x))}{c(n)}}$$ We also learned how to bridge entirely different paradigms—merging low-level packet sniffing (Scapy) with cutting-edge AI (XGBoost), decentralized cryptography (Solidity), and modern web architecture (React).

What's next for Anvex

Our vision is to deploy ANVEX as the standard sovereign cyber-defense layer for critical infrastructure. Our immediate strategic roadmap includes:

  1. 100 Gbps Line-Rate Scaling: Integrating eBPF and DPDK (Data Plane Development Kit) for kernel-bypass packet ingestion, allowing the sensor to handle national defense backbone speeds with near-zero CPU overhead.
  2. Air-Gapped Federated Learning: Enabling decentralized AI model updates across isolated military or nuclear facilities without exposing proprietary network telemetry to the outside world.
  3. Post-Quantum Forensic Ledger: Upgrading our EVM notarization hashes to NIST PQC (Post-Quantum Cryptography) standards to ensure the legal chain-of-custody remains unbroken even in the quantum computing era.

Built With

Share this project:

Updates

Submission history