State, not address
Each event (NetFlow, IPFIX, BGP prefix change) projects into a 256-D vector via SHA-256 feature hashing. Two flows with the same IP and different behavior stop being the same alarm.
AS273408 · Sherlock
LPM · TRIE
2.5 ns
Prefix lookup2.5 ns
State256-d
Verdictanomaly
Actionedge block
Your network cannot wait for an analyst.
The attack arrives at the edge. The decision does too. We work with carriers, ISPs, and data centers that must mitigate without sending traffic away from home.
The problem
Off-the-shelf NDR and SIEM capture traffic, push volume to a third-party cloud, and return an alert to an analyst. A bad-IP list goes stale in minutes. Whoever rotates addresses stays inside. Whoever must operate isolated is left without a tool.
A reputation list goes stale in minutes. Whoever rotates an address (and any modern proxy does) stays inside. Whoever cannot export flow, by regulation or by choice, is left without a tool. Yournet has run AS273408 since 2014 without a signature cloud. NIS-Sherlock implements BGP-4 (RFC 4271) with multiprotocol extensions (RFC 4760) in pure Go — no GoBGP, no BIRD, no FRR — IPv4 and IPv6 native. Each event projects to a 256-D vector via SHA-256 feature hashing; the block decision only leaves after an N-of-M quorum, on MikroTik through the RouterOS API (8728/8729), or on Cisco, Juniper, or any router reachable via SSH-key or gRPC. SOGIA v3.5 runs on a TPacket zero-copy ring buffer (AF_PACKET) with a bare-metal Rust `no_std` module for ARM/RPi3B, inspecting the header before the kernel allocates a socket. Fits in <2 GB of RAM and <5% of an x86 CPU.
What the work includes
Prefix lookup in 2.5 ns
Unified IPv4/IPv6 in-memory route table. Longest prefix match as a bitwise trie. The number is from the bench, not from a slide.
N-of-M quorum at the edge
Blocks and redirects only leave after a quorum. Execution on MikroTik (RouterOS API 8728/8729), Cisco, Juniper, Huawei. No ticket queue.
Actually air-gapped
No signature lookup in the cloud. If an external model is called, Guardian-Proxy (Aho-Corasick O(1) per character for CPF/CNPJ/Luhn, <2 ms overhead) watches the door.
How we step in
- 01
Read the state, not the address
Each event (NetFlow, IPFIX, BGP prefix change) projects into a 256-dimension vector via SHA-256 feature hashing. Two flows with the same IP and different behavior stop being the same alarm.
- 02
Decide in quorum at the edge
Mitigation only leaves after an N-of-M quorum. Execution on MikroTik (RouterOS API 8728/8729), Cisco, Juniper — SSH by asymmetric key or gRPC. No ticket queue.
- 03
Operate isolated
The system runs air-gapped, in <2 GB of RAM and <5% of an x86 CPU. It fits at the edge of the network you already have.
Where the problem usually shows up
NIS-Sherlock (own BGP-4 RFC 4271 + RFC 4760, 256-D vector, N-of-M quorum) + SOGIA (Ultra-Firewall v3.5, TPacket zero-copy AF_PACKET ring buffer, bare-metal Rust no_std module for ARM/RPi) + Guardian-Proxy (sovereign LLM gateway, Aho-Corasick O(1) per character for CPF/CNPJ/Luhn, <2 ms overhead) + Auth-System/Biolog (Linux PAM in Go with RGB biometrics and TPM-derived keys). Yournet operates AS273408 on this stack, inside and outside.
“The bad-IP list goes stale before the analyst opens the ticket.”
“You cannot send traffic to anyone's cloud.”
“The attacker rotates address and stays inside.”
“The tool you bought requires the Internet to function.”
HOP 07 · CONTATO
Tell us the problem. We answer.
Network, data center, ISP, clinic, firmware, agent, database — or any combination. Who answers is who operates what we deliver.
José Rinaldi
Founder · Engineer
Direct channels
HBR 167, 935, Block C — Suites 2001-2009, Holambra/SP, 13829-899, Brazil · Mon–Fri, 9am–6pm (BRT)