joidiego/detection-struts-cve-2017-5638-detectorReal-time anomaly detection system for Apache Struts CVE-2017-5638 exploit using streaming analytics, 3-gram byte analysis, and Count-Min Sketch. Detects RCE attacks without signatures, with <5ms latency and <0.1% false positives.
Zero-Day Exploit Detection Based on Streaming Analytics & Probabilistic Data Structures
This project is a real-time anomaly detection system designed to detect RCE (Remote Code Execution) exploits on Apache Struts through the CVE-2017-5638 vulnerability, without relying on known signatures or patterns.
CVE-2017-5638 is a critical vulnerability used in the 2017 Equifax attack, which led to the personal data breach of 147 million people. This attack succeeded due to patch management failure and lack of early detection.
This system addresses those weaknesses by:
Goal: detect zero-day exploits before the system is compromised, even if the payload has never been seen before.
