SnortML brings ML to intrusion detection

SnortML runs machine learning inference inside Snort 3 on local devices, producing a verdict in under 350 microseconds on a 4.7 GHz AMD processor. The LSTM-based model detects SQL injection, XSS, and command injection attacks. It operates in parallel with traditional signatures, catching novel variants that no rule exists for.