Lightweight APT detection agent using compact system models
Madeline is a lightweight cybersecurity system that detects advanced persistent threats — the slow, stealthy attacks that often go unnoticed for months — by watching statistical patterns in normal computer activity rather than building complex relationship maps of every system event. It uses a type of neural network called an LSTM autoencoder to learn what normal behavior looks like and then flag subtle deviations over time, all without needing anyone to manually label past attacks or maintain a database of known threat signatures. Because it avoids the computationally expensive graph-building that most comparable systems rely on, it can run continuously on modest hardware. The result is a real-time anomaly detector that gets smarter over time without requiring constant human tuning.
What you could build
A continuous endpoint or network monitoring agent — deployable on-premise or as a cloud service — that detects APTs without requiring threat-intelligence feeds or labeled attack data; target buyers are enterprise security operations centers and managed detection and response (MDR) vendors.
Who in Virginia should care
Northern Virginia's dense concentration of federal contractors, cloud infrastructure providers (AWS, Azure), and defense primes makes this a natural fit for organizations needing lightweight, continuous monitoring of sensitive environments.
Readiness: Lab validated
Concept — described but not yet demonstrated. Lab validated — supported by experimental results in the patent. Prototype likely — the text describes a built, working embodiment.
Readiness is inferred from the patent text, not from a lab visit.
The record
- Inventors
- Danfeng Yao, Wenjia Song
- Filed
- Patent pending — filed November 7, 2025
- Status
- Application
- Publication number
- US20260134091A1
Ready to talk?
Virginia Tech Intellectual Properties handles licensing for this technology.
Prosim summaries are generated from public patent text and are not legal advice.