Anamorph ray mark

Prove that your network detection actually works — offline, deterministically, with reproducible evidence.

git clone https://github.com/AnamorphLab/anamorph
cd anamorph && make install

Requires a Rust toolchain — rustup.rs. Pre-1.0: no prebuilt binaries yet.

Operator Quickstart → Why Anamorph

Check it works — offline, in about a second:

$ anamorph self-test
  [1/4] ok — synthesize SBM (100 nodes, 4 communities): 100 nodes
  [2/4] ok — synthesize cSBM with 16-dim features: 80 nodes, dim 16
  [3/4] ok — config validation surfaces a known warning: 1 warning(s) surfaced as expected
  [4/4] ok — version metadata reachable: anamorph 0.1.0
self-test PASSED

Then anamorph demo runs the full pipeline on traffic it synthesises itself — no capture of your own needed.
Entirely offline, a single binary: no cloud, no agents, no telemetry.

Why you need it

You're accountable for coverage you can't verify

Detection drift. Rules and models decay silently. Last quarter's "we detect this" is not this quarter's — and nothing safely re-validates it.
Blind spots. Adversaries reshape traffic — adding flows, shifting timing, bending the graph — until your detector goes quiet. Today you find the gap when they do.
Compliance gaps. NIS 2, IEC 62443, DORA, and ISO 27001 increasingly demand evidence of detection effectiveness, not a policy document.
The air-gapped gap. SaaS breach-and-attack tools are banned from air-gapped, OT, and classified networks — exactly where the stakes are highest.

How it works

One adversarial loop, entirely offline

Anamorph turns a packet capture into an adversarial graph, perturbs it under a controlled budget, reprojects it to checksum-correct traffic, and measures the resulting detection delta — the Sim2Real Drop.

A single signed binary — no cloud, no agents, no callbacks, and nothing ever transmits on the wire. A blue-team resilience validator, not an attack tool.

What you get

A report your auditor can re-run

The deliverable is a deterministic, hash-verifiable Detection Assurance Report — the artifact your CISO hands to the auditor.

  • Resilience score and per-attack-class blind spots
  • Remediation guidance you can action
  • Control mapping — ISO 27001:2022 · NIS 2 · IEC 62443-3-3 · DORA
  • Byte-for-byte reproducible — an auditor re-runs it and gets identical evidence
  • Ed25519-signable with anamorph sign / verify

Who it's for

Three audiences, one engine

Security teams
A PCAP, Suricata alerts, and an ML-NIDS to prove — triage incidents, carve evidence PCAPs, and produce a reproducible compliance report.
Researchers
cSBM / DC-SBM generators, PCAP→PyG Data loaders, PGD attacks on a realizability cone, and baseline-F1 → adv-F1 metrics.
Students
pip install anamorph, a clean PyTorch Geometric API, and runnable notebooks — no Rust build required.

Get started with Anamorph

Free and open source under Apache-2.0 — the engine, the research library, and everything in between.

Read the docs → GitHub