Real traffic, not synthetic data.
Behavioural baselines built on your actual network - not vendor lab conditions or sample datasets.
[01] · WHAT IBSR DOES
Watches your traffic. Reports patterns home.
IBSR runs on operator infrastructure at kernel-level resolution. It builds a behavioural baseline of your traffic, identifies anomalies against that baseline, and reports findings to Mesh. It produces counterfactual evidence - this is what I would have blocked, and why. IBSR never enforces; that is Guard's role, on instructions Mesh has earned the authority to issue.
[02] · WHY IT MATTERS
What you get.
Counterfactual rehearsal.
See exactly what would have been blocked, before anything is. Earn the authority on evidence before you grant it.
Open source.
Inspect the code. Run it air-gapped. Audit every decision. No black-box vendor inference on your traffic.
[03] · DEPLOY
Three steps.
01
Install
Drop the IBSR binary onto the validator host. No sidecar daemons, no kernel module beyond what Linux already gives you.
02
Observe
IBSR builds a baseline of your traffic in shadow mode. No enforcement, no risk. Nothing leaves the box without operator sign-off.
03
Review
Read the counterfactual record. When the evidence supports action, grant Mesh authority for specific, bounded abuse classes.
ibsr · demopreview
$ curl -fsSL nullrabbit.ai/ibsr | sh$ ibsr observe --shadow▸ baseline · 7d · learning▸ counterfactual · 847 would-block$ ibsr evidence --tail▸ shadow.log · awaiting sign-off
Demo · IBSR is not yet in production. The commands above illustrate the intended workflow.
Run IBSR on your network.