Three Detection Paradigms. One Dataset. One Result.

For the last 147 days I’ve been building aRGus , an open-source Network Detection & Response (NDR) pipeline focused on behavioral detection using machine learning and real packet telemetry.

Today we completed something I personally wanted to see for a long time:

A direct comparison between three radically different network security paradigms on the same dataset, same hardware, and same analysis conditions.

Not “which tool is better”.

But what each paradigm is actually capable of seeing.

The Experiment

We used the CTU-13 Neris botnet scenario from 2011.

The malicious corpus contains:

646 malicious flows

IRC beaconing

HTTP anomalies

SMB lateral movement

classic botnet behavior patterns

Three systems analyzed the same capture:

System Paradigm

Suricata Signature-based IDS

Zeek Telemetry & anomaly observation

aRGus Behavioral ML-based NDR

Environment:

Commodity hardware

Same PCAP corpus

Same execution constraints

No tuning magic

Default…