Anomaly Detection

corelight/zeek-xor-exe-plugin

Zeek plugin to detect and decrypt XOR-encrypted EXEs

nsol-nmsu/fml-network

FLNET2023 is a dataset designed for intrusion detection in Federated Learning scenarios. It's built using the CORE emulator, simulating a realistic…

aniketkarne/aco-prompt-shield

Stop prompt injection attacks before they reach your LLM — zero API costs, runs entirely locally, integrates in 2 minutes. Prompt injection is the…

lightless-labs/third-thoughts

Research toolkit for analyzing AI agent behavioral patterns through multi-disciplinary corpus analysis. Parses session logs, runs 23 analytical…

functori/argos/argos

Analysis and Representation of Graphs of Suspicious Operations (Analyse et Représentation des Graphes des Opérations Suspectes)

liuz233/harde

Research code for HARDE, an agent harness that probes and adaptively optimizes components for runtime risk detection and execution control across…

anecdotes-yair/trust-my-agent-ai

Security & Compliance bodyguard for OpenClaw agents

devinblack001/ddos-reduction-system

Adaptive two-stage Layer 4 DDoS mitigation gateway using behavioral traffic analysis, Random Forest classification, and kernel-level ipset/iptables…

yeasen-z/leakgauge

Detects LLM context-leakage attacks by training lightweight behavior probes on log-probabilities, with vLLM offline/server detection pipelines.

jepsen-io/duckdb

Jepsen-based transactional correctness testing framework for DuckDB, detecting isolation anomalies like G2-item and SSI violations via randomized…

spectralzero/netscope

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

leitwacht/leitwacht

Leitwacht control plane — runtime security for GitLab Runner CI/CD: policy authoring, multi-tenancy, audit, GitLab integration

nawaralseelawi/pvbrf-id

Simulation code and results for a private, verifiable, Byzantine-robust federated intrusion detection protocol using secret sharing, Merkle audits…

nccgroup/reactor

Runs custom filters on Elasticsearch and alerts on matches

yxf203/defense-as-skill

Runtime guard skill that detects and blocks malicious skill-induced attacks in skill-augmented agents, with an MCTS loop that evolves the guard…

corelight/zeek-quasarrat-detector

Zeek detector for QuasarRat

mahdi13830510/cve-2026-31431-mitigation-suite

Kernel-runtime defense framework for AF_ALG vulnerabilities, featuring eBPF socket tracing, Ansible hardening, and a crypto auditor for drift…