BEAM: Behavioral Detector for Supply Chain Compromise

Netskope Threat Labs · 2023 — Python, XGBoost, Isolation Forests, cloud telemetry

Open-source framework for detecting supply chain compromise via behavioral profiling of software delivery pipelines — no endpoint agents required. 186+ behavioral features; XGBoost / Isolation Forest ensemble for high recall and low false-positive rates.

Presented at Black Hat USA 2025: "Your Traffic Doesn't Lie: Unmasking Supply Chain Attacks via Application Behaviour."

[recording] [slides] [webpage] [blog]

JARM Randomizer

Mar 2021 — Python 3, OpenSSL, TLS/SSL

Iterates over server-side TLS versions and cipher suites to defeat JARM fingerprinting. Presented at HITBSecConf Amsterdam 2021.

Censys-ML (Beta)

Aug 2019 — Python 3, Google BigQuery, censys.io, ZMap

Scalable transformation of censys.io scan data into ML-ready feature sets.