AI-Based Detection of Cyber Threats in Unidirectional IP Traffic
National Technical Research Organisation (NTRO) · Blockchain & Cybersecurity · Software
One of the best-specified security problems in the set — the traffic-generation tools are named so you own your data, and the passive constraint is a clean framing NTRO will respect, so build the per-class detectors well and take false positives seriously.
Data: Synthetic and lab-generated traffic: benign from iperf3/Ostinato/TRex; attack from hping3, Slowloris and others
What it actually is
Critical infrastructure monitors its network through a data diode that copies traffic one way into an isolated enclave, so the monitoring system can see everything but can never send anything back — no probes, no handshakes, no blocking. The ask is an AI pipeline that detects and scores cyber threats using only what it can passively observe from that one-directional feed, with the specific threat types named.
What to build
A passive detection pipeline ingesting a one-directional stream of packets and flow records that can never re-contact the source, detecting the named threat classes from observable statistics: volumetric and protocol DDoS from flow-level rate and source-IP entropy, botnet command-and-control beaconing from periodicity and inter-arrival analysis of flows repeating toward few destinations, and DGA domains and DNS tunnelling from entropy and n-gram analysis of query names, each producing a labelled alert with a confidence score and supporting evidence on a dashboard, using models trained on the lab-generated benign and attack traffic the description specifies.
Smallest thing that wins the room
Replay a passive capture mixing benign traffic with a SYN flood and periodic C2 beaconing, and show the pipeline flagging both — the flood by its source-IP entropy collapse and the beaconing by its regular inter-arrival period — each as a scored alert with the evidence that triggered it.
How crowded this one gets
A guess, projected from the 2025 statements — the last year where both the submission counts and the winners were published.
Quieter than 84% of the 226 · #37 of 226 by expected field
Few teams are likely to go here. The best odds on the board come from statements like this.
Why: defence, intelligence and space bodies drew small fields.
This is a guess, not a fact
Nobody has published 2026’s numbers yet. This is an analysed estimate from last year’s pattern, so please do not take it as the truth — check the live counter on the SIH portal before you decide anything. The range covers the middle half of likely outcomes, so one statement in two lands outside it. Entry closes at 500 ideas per statement, so no range goes past that — a statement that reaches the cap fills and shuts rather than drawing an unlimited crowd. The model reads only three things a team can see before choosing — software or hardware, the theme, and what kind of body posted it — and those explain about a quarter of the variation in last year’s field sizes (R² 0.25 on held-out statements). Trust the band more than the number, and the ordering more than either. It cannot see how good your idea is, which is the part that actually decides it.
The scores
The number is the shorthand. The line under it is the reason.
Acceptance potential
4/5A strong pick — the specification is complete, the traffic-generation tools are named so you can build your own labelled data, the passive constraint is a genuinely interesting framing rather than a limitation, and NTRO judges will value a detector that respects the one-directional reality most IDS work ignores.
Feasibility
4/5The description names the exact tools to generate training traffic — iperf3, hping3, Slowloris — and public datasets like CIC-IDS exist, the detection methods for each threat class are well-documented, and the passive-only constraint actually simplifies the problem by ruling out active response.
Innovation scope
3/5The threat classes and the statistical signals for each are named in the description, so your room is in the detection models and in fusing the per-class detectors into a coherent scored alert stream rather than in choosing what to detect.
Clarity
5/5The description explains the data-diode constraint precisely, enumerates the exact threat classes with the observable signal for each, names the traffic-generation tools, and specifies the output as scored alerts with evidence — an exceptionally complete specification.
Effort
HeavyGenerating a realistic labelled traffic corpus, building the per-class detectors and fusing them into a scored dashboard is focused, well-bounded work with clear sub-tasks.
Demo-ability
EasyReplaying a capture and watching distinct attacks light up with the specific statistic that flagged each is a clean, self-explanatory demo that a security judge reads instantly.
In its favour
- Green flag: The description names the exact tools to generate benign and attack traffic, so you can build a fully labelled dataset yourself with no data-sourcing risk
- Green flag: The passive one-directional constraint is a genuinely interesting framing that rules out active response and forces a cleaner detection problem
- Green flag: Each threat class comes with its observable signal already identified, so your detector design has a defensible basis
- Green flag: Public IDS datasets like CIC-IDS supplement your generated traffic and give you established benchmarks
Against it
- Red flag: Flow-based detectors trained on lab traffic often fail on real traffic because lab attacks are cleaner and more separable than real ones, so your accuracy will look better than it would deploy
- Red flag: C2 beaconing detection by periodicity produces false positives on legitimate periodic traffic like software update checks, and handling that is the real challenge
- Red flag: The passive constraint means you can never confirm a detection, so precision and evidence quality matter more than recall and a naive high-recall detector floods the analyst
- Red flag: Encrypted DNS increasingly hides the query names your DGA and tunnelling detection depends on, a limitation worth acknowledging
What you will be writing
- NetFlow/IPFIX flow feature extraction
- Source-IP entropy + rate statistics for DDoS
- Inter-arrival periodicity analysis for C2 beaconing
- DNS query entropy / n-gram DGA detection
- Isolation Forest / gradient boosting on flow features
- Scapy + hping3/Slowloris traffic generation, Grafana dashboard
- Network intrusion detection
- Passive traffic analysis
- Critical infrastructure security
Prior art to read before you start
passive flow-based threat detection · botnet beaconing detection · DGA and DNS tunnelling analysis
Analysed by Claude Opus. Every score above is a judgment call with its reasoning attached — kindly cross-check this against the official statement on the SIH portal before your team commits to it.