ML Defender (aRGus NDR): An Open-Source Embedded ML NIDS for Botnet and Anomalous Traffic Detection in Resource-Constrained Organizations
About
Ransomware and DDoS disproportionately hit hospitals, schools, and small organizations that cannot afford enterprise security. We present ML Defender (aRGus NDR), an open-source C++20 NIDS with embedded ML inference, deployable on commodity hardware at 150-200 USD, over an eBPF/XDP + ZeroMQ pipeline with a dual-score Fast Detector + Random Forest. On the curated CTU-13 Neris behavioral subset (646 flows) it attains F1=0.9985, Recall=1.0000. In a three-paradigm comparison under identical conditions, Suricata (50,010 ET Open rules) generates zero alerts, Zeek observes the full botnet profile yet alerts on 14 flows (F1=0.042), and aRGus classifies the behavioral footprint (Recall=1.000). Joining each sensor to the labeled ground truth by 5-tuple, we measure per-lens bias over 14,188 botnet flows: Zeek 99.9% visibility, Suricata 1.5% (protocol anomalies, not C2 signatures), aRGus a coarse 0.2% in which the ML score averages 0.07 while the heuristic carries detection -- a ground-truth-anchored instance of the Sommer-Paxson distribution-transfer failure. Against a true denominator from the offline pcap (14,255 flows), the 67-flow (0.47%) blind spot is bounded to replay fidelity, not detection loss. Every figure is regenerated by a Makefile target. Results are under controlled replay on a single 2011 scenario, not universal detection. MIT license.