AI-Driven Stealthy Threat Detection
Stealthy cyberattacks leverage sophisticated techniques to evade detection by traditional EDR systems. This challenge requires participants to build a robust, AI-powered anomaly detection pipeline capable of identifying such advanced persistent threats (APTs) from simulated endpoint detection and response (EDR) logs. The pipeline must orchestrate data ingestion, feature engineering, and anomaly detection using `Apache Airflow`. Key to this challenge is the intelligent processing of unstructured log data: `Marvin` will be used to extract structured entities and enrich context from raw, natural language log entries. Furthermore, `GPT-5` will be leveraged to generate synthetic attack patterns or provide deeper threat intelligence context to help in model training or alert analysis, making the detection system more resilient and informed. The ultimate goal is to minimize false positives while maximizing the detection rate of low-and-slow, evasive attack behaviors.
What you are building
The core problem, expected build, and operating context for this challenge.
Develop an Airflow-orchestrated pipeline for stealthy threat detection from EDR logs, using Marvin for structured data extraction and GPT-5 for threat intelligence or synthetic data generation.
How work is evaluated
The evaluation will focus on the functional correctness of the Airflow pipeline, the accuracy of Marvin's extraction, the utility of GPT-5's integration, and the performance of the anomaly detection model in identifying stealthy attacks from simulated EDR logs.
Challenge datasets
Public datasets, plus the private datasets you have access to.
What you should walk away with
Design and implement an end-to-end data pipeline using `Apache Airflow` for EDR log processing.
Utilize `Marvin` for intelligent, structured information extraction from unstructured security logs.
Orchestrate the entire workflow, from data ingestion to alert generation, with Airflow.
Integrate `GPT-5` to enhance threat intelligence or generate realistic synthetic attack scenarios.
Develop and train an anomaly detection model capable of identifying stealthy attack patterns.
Reference links and supporting material
Sample data for 4 tasks
Challenge setup
The evaluation will focus on the functional correctness of the Airflow pipeline, the accuracy of Marvin's extraction, the utility of GPT-5's integration, and the performance of the anomaly detection model in identifyi...
Challenge input
Airflow DAGs, simulated EDR log files (CSV/JSON)
Agent execution
No agent tool is listed for this challenge.
Evaluated output
Log indicating successful DAG run, processed data artifacts, anomaly alerts
- The provided Airflow DAG completes execution without critical errors.
- Marvin correctly identifies and extracts essential information from log entries (F1-score > 0.7).
- The anomaly detection model can be trained and makes predictions.
- Anomaly Detection F1 Score target: 0.8
- Docker execution harness
Summary shows the first task, up to three tools, and up to three evidence items. Open the technical recipe to view all configured items.
View technical recipe
Configured tools
No tool records are attached.
Evaluation contract
- The provided Airflow DAG completes execution without critical errors.
- Marvin correctly identifies and extracts essential information from log entries (F1-score > 0.7).
- The anomaly detection model can be trained and makes predictions.
- Evidence of meaningful integration of GPT-5 for data generation or intelligence.
Metrics
- Anomaly Detection F1-score · Target 0.8
- Marvin Extraction F1-score · Target 0.9
- Airflow DAG Task Success Rate · Target 100
Workflow tasks
- Task 1
Input: Airflow DAGs, simulated EDR log files (CSV/JSON)
Output: Log indicating successful DAG run, processed data artifacts, anomaly alerts
Execution harness: Docker
- Task 2
Input: Raw EDR log snippet, expected structured output
Output: JSON with extracted entities, F1-score for extraction
Execution harness: Python
- Task 3
Input: Processed features from logs, true labels for anomalies
Output: JSON with detection metrics (Precision, Recall, F1-score, AUC)
Execution harness: Python
- Task 4
Input: GPT-5 generated synthetic log entries or threat analysis reports, prompts used
Output: JSON report summarizing utility and relevance
Execution harness: Python
Recipe freeze marker
No recipe freeze time is recorded.