Learning-to-Detect
shuangliangx/learning-to-detectDetects unknown jailbreak attacks in large vision-language models using hidden state analysis and autoencoders, with training and evaluation…
ai-securityanomaly-detectiondefensive-tools+2
1
shuangliangx/learning-to-detectDetects unknown jailbreak attacks in large vision-language models using hidden state analysis and autoencoders, with training and evaluation…
mahdi13830510/cve-2026-31431-mitigation-suiteKernel-runtime defense framework for AF_ALG vulnerabilities, featuring eBPF socket tracing, Ansible hardening, and a crypto auditor for drift…
cyberdudebivash/cyberdudebivash-5g-core-key-rotation-ghost-admin-auditorProduction-grade tool for detecting & remediating CVE-2026-0622 (Ghost Admin privilege escalation & master key exposure in 5G core software).
tracebyte8/systraceLinux system-call monitor using ptrace to trace file, process, network, and memory activity, with namespace isolation and machine learning…
gpt-laboratory/trustworthyragAn Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Retrieval-Augmented Generation Systems.
falcosecurity/falcoReal-time cloud-native runtime security agent for Linux that monitors syscalls and container/Kubernetes metadata to detect anomalous behavior and…
vedantk6403/koobe-guardLinux kernel module using Kprobes to detect and neutralize CVE-2024-1086 heap double-free exploits via temporal gap tracking and active register…
0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
xrazymee/ragsieveSelf-referenced local contrast for knowledge-poison detection in retrieval-augmented generation
yingtaoren/d-scanAnalyzes LLM internal states and 100+ attention/probability features to train classifiers that detect document poisoning attacks in RAG systems.
cyb3r-monk/rita-jImplementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
puniaze/portdogNetwork anomaly detector that monitors raw packets to identify port scanning activity in real time, with flexible sniffing duration controls and live…
corelight/ripple20A Zeek package for the passive detection of "Ripple20" vulnerabilities in the Treck TCP/IP stack.
corelight/zeek-long-connectionsZeek package for tracking long connections to report them before they have completed.
corelight/zeek-xor-exe-pluginZeek plugin to detect and decrypt XOR-encrypted EXEs
amavis/amavisamavis is a high-performance email content filter framework written in Perl.
syworks/wireless-idsAbility to detect suspicious activity such as (WEP/WPA/WPS) attack by sniffing the air for wireless packets.