Detection rulesets

TCP Stream Integrity

TCP state-machine, sequence and reassembly violations — early signals of session hijacking and IDS evasion.

TCP Timestamp Anomaly Segments whose TCP timestamp option conflicts with the session context.
Excessive Retransmissions The same segment retransmitted above threshold.
Out-of-window FIN/Segment FIN or segments outside the TCP receive window.
Wrong Sequence Number Packets carrying an unexpected seq during handshake or teardown.
Invalid ACK Packets with an ACK number inconsistent with session state.
Handshake Evasion Manipulated 3-way handshake seq/ack that disrupts IDS reassembly.
SYN Resend Anomaly Repeated SYNs with differing seq during connection setup.
Excessive Distinct SYNs Connection attempts with many differing SYN/SYN-ACKs.
Suspected RST Injection RSTs injected out of step with the session flow.
Reassembly Overlap Segments with differing content overlapping the same offset.

Packet/header decode integrity (checksum, options, length). Mostly noise, sometimes forgery or fingerprinting.

Application-layer protocol deviations — port masquerading, tunneling and covert-channel signals.

One-direction Protocol Application protocol seen in only one direction.
Protocol Mismatch Application protocol differing from the port/direction expectation.
Wrong-direction First Data First data flowing in the opposite direction to expectation.
Unexpected Protocol A protocol that cannot legitimately appear in this session.
STARTTLS Downgrade No TLS switch after STARTTLS negotiation.

HTTP protocol violations — request smuggling, WAF bypass and host-header attack surface.

Response Desync (Smuggling) HTTP flow where request-response pairs cannot be matched.
Unexpected Request Body A body present on a method that should carry none.
Incomplete Request Line A request line that does not terminate to spec.
Non-compliant Character Spec-violating characters in the method or URI.
Host Header Anomaly Requests with a missing or malformed Host header.

TLS handshake and record anomalies — downgrade, scanning and exploit (Heartbleed) surface.

DNS response anomalies — cache poisoning, spoofing and reflection signals.

SMTP session anomalies — spam, relay abuse and mail-server probing.

Web application attack patterns — nginx suspicious requests classified into recon, injection and RCE.

Secret-file Scan Suspicious requests targeting .env, .git, config and key files.
Path Traversal File access via ../, encodings and system paths.
SQL Injection UNION, information_schema and boolean/time-based SQL payloads.
Cross-site Scripting Script tags, event handlers and cookie-access payloads.
Remote Code Execution Probe Shell, command-exec, deserialization and JNDI payloads.
Admin-page Assault Repeated access to wp-login, phpMyAdmin and admin console paths.
Malicious Bot/Scanner UA Attack-tool User-Agents such as sqlmap, nikto and masscan.
Other Suspicious Requests Remaining is_suspicious requests not matching the patterns above.

Machine-learning anomaly detection — an unsupervised autoencoder catching deviation from the learned baseline.

Kitsune Autoencoder Anomaly An unsupervised ensemble autoencoder flagging anomalous IPs by reconstruction error vs. normal.

Rule-based heuristics — scanners, brute-force, bots and rate anomalies blocked by explicit rules.

srct Heuristic Detection Hits on recon scanner, admin brute, bot UA, 4xx flood, JA3 diversity and TCP short-scan rules.

TLS client fingerprint (JA3) analysis — fingerprint rotation, botnet and automation detection.

JA3 Rotation/Botnet A single source rotating many JA3 fingerprints across TLS connections.