AI Cyber Defense / Network detection, DNS and egress analytics
AI Cyber Defense: Normalize IPv6 addresses before correlation
Normalize addresses with a standards-aware parser and keep the original value. Join temporary addresses using device records rather than assuming an address always denotes one host.
Environment and inputs: Network detection and response using resolver logs, proxy metadata, flow records and optional Zeek or Suricata sensors.
Scenario and goal
Equivalent IPv6 text representations can fragment one endpoint into several entities in a detection pipeline.
Why it matters
For this scenario, expect behavior to vary across destinations, timing and client software. Network metadata supports a hypothesis, while endpoint and identity records often explain the actor and purpose. Account for encryption, sampling and sensor placement before interpreting absence. A statistical anomaly, protocol fingerprint or unfamiliar domain should remain a supporting observation until its consequence and business context are established.
Evidence to collect
Inspect canonical address parsing, temporary-address history and asset assignments at the event time.
Validate with an authorized exercise
Feed compressed and expanded forms of the same synthetic address; verify one network entity results while the original strings remain available as evidence.
Synthetic technical example
Python standard-library example using synthetic addresses. This normalizes text only; it does not establish which device owned an address at the event time.
from ipaddress import ip_address
samples = ['2001:db8:0:0:0:0:0:17', '2001:db8::17']
canonical = {str(ip_address(value)) for value in samples}
assert canonical == {'2001:db8::17'}
print(sorted(canonical))Rollout and checks
Preserve event time, source tuple, sensor identity and the original record identifier for every decisive observation. Verify clock alignment and collection health before joining sources. Compare a representative benign workload with the suspected behavior in a lab or stored-event replay. Adjust a detection only after documenting which observed distinction justifies the change.
Scope and limits
This guide proposes a defensive test; it is not a tested production design. Check platform support and local requirements. References explain the mechanisms but do not certify the design. Behavior alone does not prove AI involvement.