Machine Learning Intrusion Detection Built for Tor Onion Services

Alliinase Defence is a small United Kingdom company working in computer and network security, with a product line aimed squarely at Tor onion services. Its buyers are the administrators who run .onion infrastructure and the people who depend on those services staying anonymous: privacy-focused publishers, secure drop points, research and journalism projects, and any operator whose exposure risk is identification rather than data theft. The company describes its work as a next generation onion application firewall combined with a machine learning intrusion detection system.

The product sits in front of an onion service and inspects request behavior for patterns associated with deanonymization, including network investigative techniques and traffic-confirmation style probing, rather than only matching conventional web attack signatures. The company's Ouch technology is described as giving .onion system administrators the ability to detect attacks on their infrastructure and respond to them proactively. Classification is model driven, which is the stated reason for using machine learning instead of static rules against adversaries that vary their approach.

The positioning rests on a threat model gap: onion services face a different adversary than clearnet services, and mainstream web application firewalls and intrusion detection products are not designed around the risk that a global passive adversary observes the network. Alliinase Defence targets that narrow gap instead of competing with general purpose network security tooling. At the time of writing the company's domain does not resolve, so current product availability and roadmap could not be confirmed directly.