Technology: Sensor Network and AI

How NetProtector collects data from a global sensor network and uses multiple AI layers to detect, classify and block attacks.

The Sensor Network

NetProtector collects data where attacks become visible – at customer sites, at the major hubs of the internet, in purpose-built decoys and at partners.

The sensor network

Analysed data

Deep packet inspection (layers 2–7)NetFlow / IPFIXDNS queries & responsesTLS/SSH handshake metadataSyslog & event logs

The data analyzed includes:

Deep Packet Inspection on layers 2 to 7 of the OSI model,
NetFlow/IPFIX data streams for traffic analysis,
DNS queries and responses (passive DNS),
Metadata from TLS and SSH handshakes – without decryption,
Syslog data and event logs.

Together, this adds up to millions of events per second. No human can review this volume – and this is exactly where AI comes in.

AI Analysis in Four Layers

The analysis runs in several stages, each combining different machine learning methods. In this way, the mass of events is turned into a small number of prioritized alerts and concrete protection rules.

AI analysis on four layers

Millions

of events per second

A few

prioritised alerts & protection rules

Layer 1

Anomaly detection

Learns what normal looks like and reports deviations – no signatures needed.

Autoencoder

Normal traffic reconstructs well, anomalies stand out.

LSTM networks

Spot suspicious sequences over hours and days.

Layer 2

Classification

Assigns anomalies to specific attack types.

Ensemble models

DDoS, malware C2, lateral movement, exfiltration.

Transformers

Understand logs and error messages in context.

Layer 3

Threat intelligence fusion

Links events worldwide into one picture.

Graph neural network

Knowledge graph of IPs, domains, malware and attackers.

Federated learning

Learns from customer networks without data leaving them.

Layer 4

Correlation & decision

Assesses risk and derives protective measures.

Correlation engine

Combines the signals of all sensors.

Risk scoring

A priority from 0 to 100 for every event.

Learning loop: Analysts confirm or correct assessments (supervised & active learning) – continuously lowering the false-positive rate.

Layer 1 – Anomaly Detection

Autoencoders learn without predefined rules (unsupervised) what normal network traffic looks like. Normal patterns can be compressed and reconstructed efficiently; anomalies stand out in the process. LSTM networks (Long Short-Term Memory) analyze temporal sequences and detect suspicious patterns over hours or days – such as the step-by-step reconnaissance phase of an APT attack (Advanced Persistent Threat).

Layer 2 – Classification

Ensemble methods such as Random Forest and Gradient Boosting assign detected anomalies to attack types: DDoS, malware communication with command-and-control servers, lateral movement or data exfiltration. Transformer models analyze logs and error messages in context – similar to how language models understand text, but specialized in security events.

Layer 3 – Threat Intelligence Fusion

A Graph Neural Network models the relationships between IP addresses, domains, malware samples and attackers as a knowledge graph. This allows the AI to detect connections that remain invisible to humans or conventional databases – for example, that several seemingly unrelated attacks originate from the same group.

Connecting the dots: the knowledge graph

IP addressesDomainsMalware samplesAttacker group

Layer 4 – Correlation and Decision

The Correlation Engine combines the signals from all sensors and rates each event by probability, potential damage and urgency. The result is prioritized alerts and protection rules that are distributed to all appliances.

Learning Without Disclosing Data

With Federated Learning, the AI also learns from customer networks – without sensitive data content ever leaving the respective network. Only the learned model improvements are shared. This way, real-world experience feeds into the protection of all customers.

Federated learning

Data contents stay in the customer network Only learned model updates are shared

Humans Remain Part of the Learning Loop

Where many signals are evaluated, false positives also occur. Security analysts therefore confirm or correct the AI's assessments (supervised learning); in uncertain cases, the system specifically asks for input (active learning). New models are tested under controlled conditions before rollout. The goal is a steadily decreasing error rate and ever more precise predictions.

To learn how NetProtector fits into your network and your tools, see Integration & Operation.