
jev-ids
Blazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.

Blazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.

A Zeek package for the passive detection of "Ripple20" vulnerabilities in the Treck TCP/IP stack.

ML-Based behavioral endpoint detection system for Linux machines

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

Simulation code and results for a private, verifiable, Byzantine-robust federated intrusion detection protocol using secret sharing, Merkle audits…

Single-host runtime-security dashboard on eBPF — Go agent + SvelteKit. Live process tree, network map, and rule-based alerts for plain Linux hosts.

Zeek detection for CVE-2020-16898-"Bad Neighbor"

A real-time traffic monitoring tool that detects and displays network traffic volume per IP address to identify potential DDoS attacks.

The Whale Sentinel Services

Real-time anomaly detection system for Apache Struts CVE-2017-5638 exploit using streaming analytics, 3-gram byte analysis, and Count-Min Sketch.…

HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be…

Linux kernel module using Kprobes to detect and neutralize CVE-2024-1086 heap double-free exploits via temporal gap tracking and active register…

Unsupervised deep autoencoder that flags anomalous mobile traffic: 25,000+ HTTP/HTTPS flows intercepted from a live iOS device with mitmproxy,…

ZoneMinder is a free, open source Closed-circuit television software application developed for Linux which supports IP, USB and Analog cameras.

A Simple Ransomware Vaccine

A collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon

ETW based POC to identify direct and indirect syscalls

Zeek package for tracking long connections to report them before they have completed.