KHALM

Passive network anomaly detection

Rift

A spiking neural network for the wire

Alerts you can replay.
Byte for byte.

Rift is a passive anomaly detector. It observes network telemetry, classifies it against a trained baseline, and emits per-class confidence scores — returning every packet untouched. A Q16.16 fixed-point spiking neural network with no floats in its tick path: the same brain produces the same scores on x86_64, ARM, and eBPF.

See what Rift does View on GitHub Apache 2.0
Scroll
What Rift is

A detector.
Not a firewall.

Rift watches network telemetry and classifies it against a trained baseline. Its output is per-class confidence scores — nothing more. The eBPF program returns XDP_PASS on every packet it sees, and there is no code path from Rift's output back to the wire.

Sixteen features are extracted per tick — volume, rate, protocol mix, SYN/FIN/RST counts, Bloom-cardinality of source and destination IPs, packet-size statistics, ACK ratio — then a bipolar surprise encoder turns each feature into input bits, and the network ticks: 

Telemetry → 16 features → Bipolar surprise encoder
   → SNN tick (leak · afferent · recurrent · threshold · spike)
   → Class score accumulators → Per-class confidence scores
8classes
Normal, SYN flood, UDP amplification, ICMP flood, DNS amplification, FIN scan, HTTP flood, exfiltration. Class neurons are independent — two attacks can be flagged at once.
16features
640 input bits per tick. A learned baseline of what normal traffic looks like, so anomaly is deviation from the model — not a hand-written rule.
0control paths
No drop, no redirect, no modify. The HAL exposes no operation that touches the packet path. Observation only, by contract.
Next: Byte-identical
Measured, not promised

Same bytes on every platform.

Bit-exactness is a hard requirement, not a goal. Every arithmetic operation in the tick path is Q16.16 fixed point — the engine source is checked for floating point on every commit. Replay the same brain on the same input and you get the same scores, everywhere.

0floats
Q16.16 fixed point everywhere in the tick path. No GPU, no CUDA, no stochasticity — nothing that can drift between runs or machines.
5platforms
x86_64, aarch64, Cortex-A, eBPF, SmartNIC ARM. Byte-identical output across all five, verified by the platform-invariance test suite.
100% replay parity
An analyst replaying a capture offline gets the exact same scores the live system produced. Same brain, same input, same bytes — reproducible alerts.
Next: Zero blast radius
Safety by design

Nothing between you
and the wire.

No control path
Advisory by construction
Rift's only output is per-class confidence scores, delivered to the host — never to the wire. The HAL exposes no drop, redirect, or modify operations.
Host stays authoritative
Heartbeat, not fallback
Rift signals health with a heartbeat. If it stalls, the host firewall continues with its own rules. Rift's alerts are extra context, never a dependency.
Every packet passed
XDP_PASS, always
The data plane never waits on the brain. Every packet passes through; Rift observes in parallel and reports what it sees.

Rift is not a mitigation engine. It does not drop, redirect, throttle, or modify packets. Its alerts are advisory input to a host firewall whose own rules remain authoritative.

Get in touch
Open source

Watch your traffic with a detector that keeps its word.

Rift is Apache-2.0 licensed, on GitHub. Clone it, build it, and replay the reference capture — the expected SHA-256 is in the repository.

The repository: github.com/notnullai/rift.

View on GitHub Contact KHALM