This talk introduces Planck-99, a deterministic, integer-only malware classifier (27 KB of dependency-free C source, 37 KB compiled; ~34-62 ns classifier-interface latency, about 100-190 cycles; 80-650 us end to end including eBPF syscall capture) built to run directly on resource-constrained embedded Linux hardware, with no cloud, GPU, or floating-point unit. Regulation increasingly demands auditable evidence from this device class: the EU Cyber Resilience Act, the US IoT Cybersecurity Improvement Act, Saudi Arabia's OTCC-1:2022, the UK PSTI regime and Japan's JC-STAR ask for activity-, inventory- or process-level evidence, yet none of them mandates exposing detection logic by default. I walk through the engine's glass-box architecture (a 32-dimensional integer feature vector feeding a pruned five-tree ensemble, INT8-quantized within 0.5 points of its float32 original) and an honest evaluation built on public benchmark datasets and results: one frozen model, three corpora, 96.28% accuracy on an unseen IoT corpus whose traces run up to 51x longer than anything it trained on, including a transparent look at that corpus's 12.18% false-positive rate and where it comes from. Because a built-in generator trains a new engine from labeled syscall-trace data in roughly 3 to 30 minutes, depending on the dataset, every deployment can carry its own customized version. The talk closes with a strategic argument: a compact, auditable engine that attacker and defender hold in identical form protects no one. Instead of open-sourcing the whole engine or hiding it, I propose a two-tier disclosure model: a public tier (architecture, standard audit logs, independent black-box benchmarks and public benchmark datasets) and a restricted tier (weights, thresholds and full decision paths, shared only with authorized auditors and unique to each endpoint). The speaker is commercializing Planck-99 and discloses that interest up front.
About the Presenter: Ziad Salah
Ziad Salah (Zierax) is a mission-critical systems safety, security and sustainability engineer, founder of Division-36, and an XAI/HCI researcher. His work covers low-level Linux auditing and deterministic, constrained-environment defensive engines, and he has built open-source and closed security utilities including Z-Privesc, Z-Jail and Planck-99. Registered under ORCID 0009-0002-6813-2416, he bridges kernel mechanics, mathematical precision and international cybersecurity compliance. At 18, his engineering principles center on reproducibility and glass-box security architectures that can be verified without being handed to attackers.
