ANMAS adds on-premises edition, SGS partnership for IoT packet analysis
Taiwan's Daying Technology detailed the latest development of ANMAS (AI Network Malware Analysis System) at an IoT trusted-supply-chain event, saying it finished product development in 2025 with a cloud offering and this year added an on-premises edition, with Unitech Computer helping enterprises set up local AI compute. ANMAS uses a small language model with fine-tuning, LoRA and RAG, capturing IoT device traffic in a virtual Wi-Fi environment for PCAP analysis; the company says a 500MB capture that takes an engineer about four hours is cut to roughly 10–15 minutes, and that it does not decrypt HTTPS/TLS but judges anomalies from behavioral features such as connection frequency, timing and destinations. Daying said it has collected more than 2,200 network behaviors and cites about 80% recognition accuracy generally and up to 90% in IoT/OT settings, while working with SGS Taiwan, the Institute for Information Industry, the Taiwan network packet analysis association, Systex's training center, Feng Chia University and Sanwan on verification, deployments and training.
It shows AI-based packet analysis being productized for IoT/OT supply-chain verification, where manual review cannot scale.
近日大映科技揭露AI網路封包分析系統ANMAS（AI Network Malware Analysis System）的最新發展，並攜手多方夥伴拓展IoT、OT與企業網路安全等應用。除了供應鏈檢測與場域合作，大映科技總經理劉得民也進一步說明ANMAS如何將AI運用於網路封包分析。
關於ANMAS的實際運作，劉得民指出，IoT設備的網路封包一般可透過交換器或Wi-Fi等方式取得，ANMAS則採用虛擬Wi-Fi環境擷取設備通訊流量，之後再由工程師將封包擷取（Packet Capture，PCAP）檔案送交系統，由AI模型進一步分析。
在AI架構方面，ANMAS採用小型語言模型（SLM），並搭配Fine-tuning、LoRA與RAG等技術。其中，工程師可透過RAG知識庫將分析經驗、判斷結果或其他相關知識納入系統，讓AI在後續分析時結合既有知識進行判讀。這樣的好處在於，隨著企業持續分析封包，逐步累積屬於該企業自身環境的網路經驗。
至於實際效益，劉得民以封包分析效率為例，一份500MB的PCAP檔案，若由工程師人工分析，大約需要4小時；若資料量進一步增加到數十GB，人工一天也未必能完成。以百人規模企業來看，每小時就可能產生數十GB的網路封包，更難以完全依靠人工逐一分析。透過ANMAS搭配GPU運算後，500MB封包的分析時間可縮短至約10至15分鐘。
#ANMAS#Daying Technology#SGS Taiwan#Institute for Information Industry#Systex#Feng Chia University#Unitech Computer