Security research & engineering for decentralized networks

The Decentralized Immune System for Decentralized infrastructure.

NullRabbit is an AI-powered, eBPF-enforced security layer for decentralized networks.

We map, predict, and drop hostile P2P inputs and resource-exhaustion attacks at the kernel before they cause node failure or availability loss.

Watch the Live eBPF Demo →Explore the NRDAX Taxonomy →

Attack techniques mapped417 · NRDAX Reproduced in the lab118 techniques ML training corpus1,000+ bundles · 38+ network stacks Live validator risk intelSlashr · 7 networks

[01] · The problem

Decentralized networks are vulnerable at the transport layer.

Traditional security tools don't understand libp2p gossip, QUIC handshake floods, or peer-to-peer memory exhaustion. A single malicious packet can take a network node offline. NullRabbit investigates and reproduces these exact mechanisms to build active defenses.

blind

Contract & transaction security

Audits program logic and on-chain state. Never sees the packet that takes the node down.

late

Traditional monitoring & EDR

Doesn't speak libp2p, QUIC or devp2p. Reports CPU, memory and disk after the damage has landed.

covered

NullRabbit

Maps the technique, predicts the anomaly, and drops the packet at the kernel before user space ever pays for it.

[02] · The stack

Full-stack infrastructure security research. Intelligence feeds cognition; cognition arms enforcement.

Layer 01 · The IntelligenceNRDAX

The industry's first structured taxonomy for node-resource attacks. 417 techniques mapped, crosswalked to MITRE AADAPT, published as an open, versioned registry.

417 techniques · 118 reproducedBrowse the taxonomy →Layer 02 · The CognitionML Models

HuggingFace-trained models on 1,000+ attack bundles across 38 network stacks and counting, classifying zero-day anomalies in real time.

1,000+ bundles · 38+ network stacksInspect the models →Layer 03 · The EnforcementeBPF/XDP Mesh

Kernel-level packet filtering research that drops hostile traffic before it hits the user-space daemon, with a decentralized mesh architecture for threat propagation.

Demonstrated live · active R&DSee the firewall →

1Map

2Predict

3Drop

4Propagate

[03] · Live telemetry & R&D

Active research. Live telemetry.

Everything we claim, you can query. The taxonomy, the models and the risk telemetry are live and publicly inspectable. The enforcement mesh is active research, demonstrated end-to-end. We label which is which.