WARDEN

Website blocks an IP that tries to port scan

Inspiration

Cyberthreats are a real and growing concern. Our critical infrastructure is at immediate risk. During COVID, I had a first hand experience on the dangers of inadequate security. This lead to me wanting to build WARDEN. This has been something I have wanted to build for almost 2 years now, Catapult gave me the platform.

What it does

WARDEN is a cybersecurity system that protects servers and critical infrastructure from zero-day attacks by monitoring how systems behave in real time. It doesn’t rely on known threats—instead, it detects unusual activity in the system’s logs, figures out what kind of attack it might be, and acts instantly to stop it. This makes WARDEN proactive, fast, and effective against even brand-new, unknown threats.

How we built it

We first tried to gather data of “normal” and “attack” web traffic. We then used isolation forest to train an unsupervised model based on web traffic patterns. While we were successful in training our model, our data was not fit properly. This lead to false negatives and positives. We then pivoted to a rule based protocol. This worked more effectively. We defined what “attack” traffic looks like (Scanning 20 ports in 5s) etc. We then used iptables to block the user.

Challenges we ran into

Training an AI model without access to the right data was one of our biggest hurdles. We didn’t have enough real-world threat data, which made it difficult for the model to learn effectively. As a result, we saw a lot of false positives and false negatives during early testing. On top of that, while fine-tuning the system, we accidentally banned our own IP address more than once

Accomplishments that we're proud of

We’re proud to have built a fully functional prototype of WARDEN. Despite the challenges with limited data and fine-tuning the AI, we now have a system that can monitor, detect, and respond to abnormal server behavior in real time. It’s a major step toward tackling zero-day threats with a proactive, behavior-based approach.

What we learned

Throughout the development of WARDEN, we gained a deeper understanding of the challenges involved in building AI-driven cybersecurity tools. We learned how essential it is to have access to quality, representative data in order to train models effectively. Without enough data, even the most promising models can struggle to perform accurately.

What's next for WARDEN

Next, our focus for WARDEN is on strengthening its intelligence, accuracy, and automation. The first step is acquiring a large, high-quality dataset that can accurately simulate normal server conditions. This will allow us to train our machine learning model more effectively, helping it distinguish between legitimate activity and potential threats. Finally, we aim to refine the system by automating threat responses—such as spinning up honeypots or isolating suspicious processes—so WARDEN can react instantly and autonomously to protect critical infrastructure from zero-day attacks.