Penumbra — ML Network Intrusion Detection
A known-threat classifier plus a benign-only autoencoder novelty head, built for the Microsoft track at Bennett Hackathon 2026.
- Stack
- Scikit-learn · PyTorch · Autoencoders
- Key figure
- 54.1% — Unseen-attack recall
- Context
- Bennett Hackathon 2026 — Microsoft track
DG Labs
Penumbra
54.1%Unseen-attack recall
- Known-threat classifier
- Benign-only autoencoder novelty head
- Unseen-attack recall: 8.5% → 54.1%
Scikit-learn · PyTorch · Autoencoders
01
The problem
Intrusion classifiers are good at the attacks they were trained on and nearly blind to new ones.
02
The approach
Paired a known-threat classifier with an autoencoder trained only on benign traffic, which flags anything it cannot reconstruct as novel.
03
The outcome
Recall on unseen attacks rose from 8.5% to 54.1% at a matched 2% false-positive rate.
Of note
- ✦ Known-threat classifier
- ✦ Benign-only autoencoder novelty head
- ✦ Unseen-attack recall: 8.5% → 54.1%
- ✦ At a matched 2% FPR