No labels. No thresholds. Unsupervised concept drift detection for network traffic streams — with feature-level attribution that tells you exactly which signals changed.
Most detectors tell you that something changed. Vigil tells you what changed and ranks it.
From raw network packets to automatic model retraining — Vigil orchestrates the entire pipeline.
# pip install vigil-drift from vigil import Vigil v = Vigil(feature_names=your_feature_names) v.fit(baseline_traffic) # offline phase for batch in live_stream: result = v.detect(batch) if result.drift_detected: print(f"⚠ severity={result.drift_severity:.2f}") for f in result.attribution.top_features: print(f" {f['feature_name']}: {f['contribution']:.1%}") # ⚠ severity=1.00 # → service_eco_i 15.3% (port scan signature) # → dst_host_same_src_port_rate 12.3% (scanning pattern) # → srv_diff_host_rate 11.1% (lateral movement)
Everything is on GitHub. The algorithm, the API, the Airflow DAGs, the Kafka pipeline, the dashboard. All of it.