nodesight
Architecture

Five stages.
Three milliseconds.

From raw kernel capture to SIEM alert. Runs on commodity hardware at Tor exit nodes.

Stage 01Kernel

XDP / eBPF

XDP programs attach directly to network drivers. 10Gbps line rate capture with zero-copy ring buffers. Packets never enter the OS stack.

SEC("xdp")
int xdp_exit_filter(struct xdp_md *ctx) {
    void *data     = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;
    struct ethhdr *eth = data;

    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;

    if (eth->h_proto == htons(ETH_P_IP)) {
        struct flow_key key = extract_flow_key(ctx);
        bpf_ringbuf_submit(&rb, &key, sizeof(key), 0);
    }
    return XDP_PASS;
}
Inference Engine

Proprietary architecture. Single verdict.

Protocol-Aware Tokenization

Traffic parsed at the protocol level — flow, packet, and burst features — not raw byte sequences. Captures micro-timing and macro-flow characteristics.

Mixture-of-Experts Routing

Sparse MoE architecture activates specialized sub-networks based on traffic characteristics. 2-3 experts per inference for low-latency ensemble decisions.

Adversarial Hardening

Trained against GAN-generated adversarial traffic samples. Recovers 64 percentage points of accuracy against evasion attacks without degrading clean traffic performance.

HW-NAS Edge Optimization

Hardware-aware neural architecture search produces models optimized for CPU inference. Sub-millisecond on Intel Xeon, 512MB memory footprint.

Circuit Correlation Engine

Inter-arrival timing signatures correlated against 14-month circuit databases. Maps 3-hop anonymous circuits to probable geographic origins.

Continuous Learning Pipeline

Models retrained on rolling 14-month windows. Automated A/B testing against production before deployment. Adapts to new Tor pluggable transports.

Benchmarks

Production performance

METRIC1 GBPS10 GBPS100 GBPS
Packet rate1.48M pps14.8M pps148M pps
Memory8 GB24 GB64 GB
CPU cores4816
P99 latency0.4ms0.6ms1.1ms
Drop rate0%0%< 0.01%