A real-time threat-detection system in the defense domain · ML detection pipeline
Real-time drone detection from radar streams
Detect and classify drones from raw radar tracks in milliseconds, at a false-positive rate low enough to be operationally usable.
- recall
- 97.2%
- matrix test detection
- 100%
- false positive reduction
- -84% (V1 to V3.2)
- runtime segfaults
- 0 after ONNX
- classes
- 6
- XGBoost
- LSTM
- Transformer
- ONNX Runtime
- Weighted fusion
Problem
A real-time detection pipeline had to decide, from raw radar tracks, whether a given track belonged to a drone, and if so which of six types it was, within milliseconds and without loading a human operator. The radar stream never stops, so the pipeline had to keep up with it continuously rather than in batches.
The results here are described on synthetic radar data. Hardware, protocols, and real signatures stay out of this writeup.
Constraint
Two constraints were wound together.
The first was real-time behavior. Because tracks arrive continuously, per-window latency had to be low and, more importantly, predictable. A pipeline that is usually fast but occasionally stalls is not usable on a live feed.
The second was the false-positive budget. In this domain a high false-positive rate does not just annoy an operator, it makes the system operationally unusable. Detection recall and false-positive suppression had to move together, not trade against each other.
There was also a runtime hazard: XGBoost's OpenMP (libgomp) dependency was producing segfaults on the live path. On a continuously running detector, that is not a tuning problem, it is a reliability failure.
Architecture decision
Instead of betting on a single model, I ran three in parallel and fused them.
Three-model ensemble. XGBoost reads tabular and statistical features. An LSTM and a Transformer read temporal pattern. Their outputs combine through confidence-weighted voting, so each model contributes where it is strongest instead of one model having to be right about everything.
ONNX Runtime for the tabular model. Moving XGBoost to ONNX Runtime removed the libgomp dependency entirely. The segfaults went away, and inference became deterministic and portable, which matters far more on a live detector than a marginal speed gain.
Rule-based post-filter. A final layer drops low-fusion, low-council scores to CLEAN. This suppresses false positives as a policy layer, without distorting the models underneath to chase the same effect.
Result
On the matrix test the pipeline detected 100% of drones, at 97.2% recall overall. False positives dropped 84% from V1 to V3.2, and the libgomp segfaults went to zero after the ONNX migration.
The design point was that the false-positive collapse came from architecture, an ensemble plus a policy filter, rather than from trading away recall or from overfitting a single model to the test set.