DOCSEARCHbyAlgolia
Submit Docs

NVIDIA Morpheus Documentation

repository·branch-25.10·Indexed 20 days ago

https://github.com/nv-morpheus/morpheus

An open AI application framework for cybersecurity designed for real-time IP traffic inspection and threat detection. Morpheus enables the creation of optimized AI pipelines using a Python API or CLI, supporting integrations with Triton Inference Server, cuDF DataFrames, and the Forest Inference Library (FIL). The framework supports GPU-accelerated processing as well as CPU-only execution modes.

Tokens
140.4K
Snippets
351
Records
582
Agent score
69%

What's inside NVIDIA Morpheus

  1. Overview of the GNN FSI Fraud Detection Model

    branch-25.10

    The GNN FSI model is a demonstration model designed to showcase a fraud detection pipeline using Graph Neural Networks (GNN) and gradient boosting trees. It is intended for testing and validating the Morpheus GNN FSI pipeline rather than for production use.

    Core Functionality:

    • Purpose: Identifies fraudulent credit card transactions within a transaction network.
    • Architecture: Uses a bipartite heterogeneous graph representation. It employs HinSAGE (a heterogeneous implementation of GraphSAGE) for feature embedding and XGBoost as the final binary classifier.
    • Output: Produces an anomalous score (fraud probability) between 0 and 1.

    Note: This model is for demonstration purposes and should not be used in production environments.

  2. Overview of Morpheus Datasets

    branch-25.10
    Morpheus provides small, specialized datasets designed for testing training scripts, inference scripts, and end-to-end pipelines. These datasets cover various cybersecurity domains including anomalous behavior, digital fingerprinting, fraud detection, log parsing, phishing, ransomware, root cause analysis, and sensitive information detection.

  3. Overview of the Phishing Detection Model

    branch-25.10

    The Phishing Detection model is a binary classifier designed to differentiate between phishing/spam and benign SMS or email messages.

    Note: This model is for demonstration and testing purposes only and is not intended for production usage.

    Key Specifications

    • Architecture Type: Transformers
    • Network Architecture: BERT
    • Model Version: v1
    • Inference Engine: Triton
    • Runtime: Morpheus

    Use Case

    It is primarily used by developers to test and validate the Morpheus phishing detection pipeline using synthetic datasets. It is not recommended for real-world phishing detection as different email/SMS types and content require specifically trained models.

  4. Overview of the Vector DataBase Upload (VDB Upload) Pipeline

    branch-25.10

    The VDB Upload pipeline is a demonstration of a Morpheus pipeline designed to ingest documents, segment them into chunks, generate embeddings using a model (e.g., all-MiniLM-L6-v2), and upload the resulting text and vectors to a Vector Database (VDB) like Milvus.

    Pipeline Components

    1. Document Source Handler: Fetches and preprocesses text data (e.g., from RSS feeds or web scraping).
    2. Embedding Generator: Transforms text chunks into embedding vectors (e.g., 384-dimensional vectors using all-MiniLM-L6-v2).
    3. Vector Database Uploader: Pushes embeddings and metadata to a VDB (e.g., Milvus).

  5. Overview of the Anomalous Behavior Profiling (ABP) model

    branch-25.10

    The Anomalous Behavior Profiling (ABP) model is a demonstration binary XGBoost classifier designed to differentiate between anomalous GPU behavior (such as cryptocurrency mining or GPU malware) and non-anomalous GPU-based workflows (such as ML/DL training).

    Note: This model is intended for demonstration and testing purposes only and is not suitable for production usage. It is specifically used to evaluate and validate the Morpheus ABP pipeline.

    Technical Specifications

    • Architecture Type: Gradient boosting (XGBoost)
    • Input Format: nvidia-smi output (GPU statistics)
    • Output Format: Binary results (e.g., cryptocurrency mining vs. legitimate GPU usage)
    • Runtime: Morpheus
    • Inference Engine: Triton
    • Supported Hardware: Ampere/Turing architectures
    • Supported OS: Linux

  6. Overview of NVIDIA Morpheus

    branch-25.10

    NVIDIA Morpheus is an open AI application framework designed for cybersecurity developers. It provides a highly optimized framework and pre-trained AI capabilities to inspect IP traffic across data center fabrics in real-time.

    Key capabilities include:

    • AI Cybersecurity: Deploy custom models or use pre-trained models for tasks like identifying leaked sensitive information, detecting malware, and log error identification.
    • Real-Time Telemetry: Receives rich network telemetry from NVIDIA BlueField DPU-accelerated servers without impacting performance.
    • DPU Integration: Uses NVIDIA BlueField DPUs as telemetry agents to extend static security logging into dynamic real-time telemetry models.
    • Optimized Performance: Built on RAPIDS™ libraries, deep learning frameworks, and NVIDIA Triton™ Inference Server.

  7. Explore pre-trained Morpheus models

    branch-25.10

    Morpheus provides several pre-trained models designed for specific use cases, including anomaly detection, fraud detection, and log parsing. Each model includes corresponding training scripts, validation scripts, and datasets. You can find the latest release of these models in the Morpheus repository under the models directory.

    Available models include:

    • Anomalous Behavior Profiling (ABP): An XGBoost binary classifier that differentiates between anomalous GPU behavior (e.g., crypto mining/malware) and normal ML/DL workflows. (Requires ~2015MiB GPU memory)
    • Digital Fingerprinting (DFP): An ensemble of an Autoencoder and fast Fourier transform reconstruction used to detect shifts between human and machine behavior. (Requires ~4.97MiB GPU memory)
    • Fraud Detection: A Graph Neural Network (GraphSAGE + XGBoost) applied to credit card transaction graphs to identify fraud. (Requires ~76.55MiB GPU memory)
    • Ransomware Detection Model: Uses DOCA AppShield and volatile memory data with random forest classifiers to distinguish ransomware from benign processes.
    • Flexible Log Parsing: Uses Named Entity Recognition (NER) specifically for parsing Apache HTTP Server logs. (Requires ~1612MiB GPU memory)

  12. Morpheus Model Repository Structure

    branch-25.10

    The Morpheus models repository is organized by use case. Each use case has a directory named <use-case>-models containing the model files.

    Key directories include:

    • <use-case>-models: Model files for specific use cases.
    • datasets/: Training and validation datasets.
    • training-tuning-scripts/: Scripts for training and fine-tuning (including .ipynb notebooks).
    • validation-inference-scripts/: Scripts for validating model inference.
    • triton_model_repo/: Directory structure and .pbtxt configuration files required to run models in Triton Inference Server.
    • mlflow/: Information for setting up an MLflow server to publish and deploy models to Triton.