Three Detection Paradigms. One Dataset. One Result. For the last 147 days I’ve been building aRGus , an open-source Network Detection & Response (NDR) pipeline focused on behavioral detection using machine learning and real packet telemetry. Today we completed something I personally wanted to see for a long time: A direct comparison between three radically different network security paradigms on the same dataset, same hardware, and same analysis conditions. Not “which tool is better”. But what each paradigm is actually capable of seeing. The Experiment We used the CTU-13 Neris botnet scenario from 2011.…