IEPNIS: Endpoint Intrusion Detection

[01] problem

Signature-based antivirus misses new or obfuscated attacks, so an endpoint needs to be judged on behaviour: what a process runs, who spawned it and where it connects.

[02] approach

1. 01A hybrid monitor in Python/psutil collects process, parent-child, command-line, hash and connection telemetry as state deltas and queues it in SQLite, so analysis is asynchronous and nothing is lost if the classifier is unavailable.
2. 02The classifier sends batches to Claude with structured telemetry and gets back BENIGN or MALICIOUS, a confidence score and a short explanation. Inference is deterministic, and a prompt harness compares Claude with GPT at temperature 0.
3. 03Only malicious events are published over ZeroMQ. The response engine applies policy: terminate the process, quarantine the executable (rename over delete) or block the IP with a firewall rule.

[03] what's interesting

• The messaging layer was redesigned from CSV/SQLite hand-offs to ZeroMQ publish-subscribe, which cut the coupling and lets new subscribers be added without changes to the classifier.
• Every response action has its own feature flag, and all of them ran in Dry Run mode during evaluation, so the decision logic was checked without touching the host.
• Stated limits: Windows only, a limited set of Atomic Red Team and hand-made scenarios, dependence on an external API, and live remediation not yet evaluated.

[04] stack