McAfee's Real-Time Anomaly Detection: Machine Learning Fast Enough to Score Live Traffic

McAfee is a global cybersecurity company whose anomaly-detection capability sits at the center of its commercial value proposition. They engaged Taller to develop real-time anomaly-detection models, data pipelines, and an analytics surface across email, network traffic, and IP-level endpoints.

Real-time anomaly detection was one of the areas where engineering depth was the competitive edge: a competitor who could not run machine learning at this speed simply could not ship what the market expected from a category leader. The client’s anomaly detection needed to work across several kinds of endpoints at once. The first was email campaigns, where the threat showed up as content-and-sender patterns. The second was network traffic, where it appeared as an unusual flow measured against known baselines. The third was IP-level behavior, where it took the form of reputation modeling against a constantly shifting threat landscape. The challenge was producing accurate detection across all three at the rate the endpoints actually generated data.

Taller’s backend and data-science team developed the anomaly-detection models, built the data pipeline that fed them, and shipped the analytics surface that captured insights from endpoint snapshots. Real-time machine learning at the security-endpoint layer was a different problem from offline model training: the models had to be small and predictable enough to score traffic as fast as the endpoint produced it, the data pipelines had to be reproducible from raw telemetry (the readings the endpoints send back) without slow round-trips to other systems, and the retraining schedule had to keep up with a threat landscape where adversaries adapted to a deployed detection within days. Python on top of the security-endpoint APIs was the implementation substrate; the discipline that mattered most was the model-versioning and shadow-testing method (evaluating a new model against live data before it goes live) that let the team raise detection accuracy without raising the false-positive rate.