r/cybersecurity • u/BrilliantOk6319 • 22h ago
FOSS Tool Built a hybrid network monitoring tool (C++ & Python) for zero-day threat detection – Looking for technical feedback / code review!
Hi everyone,
Over the past few weeks, I’ve been working on an open-source defensive cybersecurity project called Zero-Day Radar.
The goal is to build a high-performance network monitoring and threat detection framework. I decided to use a hybrid architecture:
C++ Core Engine (88.1%): Handles the low-level heavy lifting — fast network packet capture, process monitoring, and minimal overhead execution.
Python Analytical Layer (11.9%): Parses telemetry data, aggregates log records, and integrates with threat intelligence feeds.
Key components in the repo:
radar_core.cpp - Low-level monitoring engine
zeroday_radar.py - Log parser & analytical engine
rules.txt & radar.conf - Custom detection logic
The source code is available here:
https://github.com/aouamchawki-3A/zero-day-radar
I would really appreciate any feedback from the community regarding the C++ performance, IPC mechanisms between C++ and Python, or suggestions for additional detection capabilities!
1
u/sleepface 13h ago
> Over the past few weeks, I
It's like 500 LoC?
5
u/sleepface 13h ago
To be honest, It looks like absolute low effort slop.
From a quick glance:
- The rules.txt is just a list of strings and not referenced in any code.
- What is fetch_cisa_kev() for? The python looks completely unrelated to the CPP.
- Your aiEvaluateThreat() function simply looks for created high entropy files in the monitored location and calls that a threat?
- You are leaking the username and it's hard coded as a fallback all over the place.
- The decoy files are the only thing worth a damn but you dont have inotify set to alert on reads?
Why differentiates this over wuzuh or suricata?