
Snitch
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8…

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8…

Adaptive two-stage Layer 4 DDoS mitigation gateway using behavioral traffic analysis, Random Forest classification, and kernel-level ipset/iptables…

IOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…

PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…

Very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support

This repository includes the source code used in the "Characterization and Detection of Cross-Router Covert Channels" paper.

Blazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.

Open source entropy based invalid traffic detection and pre-bid filtering.

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Advanced detection of port scanning, DoS and malware attacks using Machine Learning techniques

The StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides…

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

The Whale Sentinel Services

A tool for malicious behavior detection in IoT devices


Maliciousness scoring for Linux commands

WiFi, Bluetooth and Ethernet Threat Detection.

User-space bot and DDoS deflection for small HTTP services