siddharth2440/network-detection-engineLightweight network intrusion detection engine capturing live traffic with libpcap. Detects SYN/ICMP floods, port scans, and signature-based web…
alperenugurlu/network_assessmentWith Wireshark or TCPdump, you can determine whether there is harmful activity on your network traffic that you have recorded on the network you…
cisco/joyA package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
blue-yonder/tsfreshAutomatic extraction of relevant features from time series:
nccgroup/detectwindowscopyonwriteforapiEnumerate various traits from Windows processes as an aid to threat hunting
nccgroup/killedprocesscanaryA canary designed to minimize the impact from certain Ransomware actors
nccgroup/mimikatz-detector-condrvThe Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent to or from…
nesg-ugr/msnm-sensorMultivariate statistical network monitoring sensor that detects anomalies using PCA-based techniques, aggregating lightweight statistics from…
mouna23/ai-driven-mitre-attackThis repository demonstrates a machine learning pipeline for detecting MITRE ATT&CK techniques from logs and enriching the output using a local LLM.
yxf203/defense-as-skillRuntime guard skill that detects and blocks malicious skill-induced attacks in skill-augmented agents, with an MCTS loop that evolves the guard…
seclog-open/seclogCollects multi-source security logs from reproducible Docker attack scenarios, builds attack chains, and provides the SecLog-Bench-216 benchmark for…
yashubitra/mobile-intrusion-detection-systemUnsupervised deep autoencoder that flags anomalous mobile traffic: 25,000+ HTTP/HTTPS flows intercepted from a live iOS device with mitmproxy,…
tirrenotechnologies/tirrenoOpen-source security framework for real-time event tracking, threat detection, and risk scoring. Monitors user behavior, detects fraud, bot attacks,…
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
cbuijs/sdproxyDNS Proxy that is simple and fast with not so simple features. Focused on routed DNS forwarding, filtering and parental control.
amavis/amavisamavis is a high-performance email content filter framework written in Perl.
silverfort-open-source/latmaCollects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…
