vet v1.19.0

Find malicious packages, vulnerabilities and risky CI workflows before they reach production. Install • Docs • Commands • Policy • Discord !NOTE This branch is vet v2, in alpha. vet v1 is on main and stays the latest release. The v2.0.0 release notes map each v1 command and flag to v2. Why vet Yo...

PhantomCall: Evading ML Malware Detectors Via Function Call Graph Perturbation

Prior adversarial attacks on Windows PE malware detectors target raw bytes, PE headers, or intra-function control-flow graphs, leaving the function call graph FCG unexplored as an attack surface. Yet the FCG structure is an important feature in graph-based malware detectors. We present Phan-...

sublime-rules — Updated!

Sublime Rules by Sublime Security This repo contains open-source rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Examples HTML smuggling VIP / Executive impersonation Malicious OneNote files Malicious LNK files...

systeminformer v4.0.26241.138

System Informer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc...

Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition

The continual evolution of malware variants necessitates detection systems that can adapt to new threats without retraining from scratch. However, continually updating models on new data often leads to catastrophic forgetting, where previously learned knowledge is overwritten. While continual...

Malformer: A Multi-Modal Malware Detector Using Transformers

Traditional malware detection systems that rely on a single representation of malware often fail to identify novel threats. These representations of malware binaries, also known as modalities, do not provide the models with sufficient information to discriminate among all samples. Additionally,...

vet v1.18.2

Quick Start • Documentation • Community !NOTE vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository. Why vet? 70-90% of modern software is open source code — how do you know it's safe? Traditional SCA tools drown you in CVE...

fibratus v3.1.0

Fibratus Security sensor for realtime threat detection and protection Get Started » Docs • Rules • Filaments • Download • Discussions Fibratus detects and eradicates advanced attacker tradecraft, malware, and emerging threats by scrutinizing and asserting a wide spectrum of system events against ...

netwatch v0.28.2

NetWatch See what your network is actually doing — live, in your terminal. A network monitor that reads encrypted traffic, names the process behind every connection, and catches malware calling home. One binary. Zero config. Everything at once, withzero rows of chrome — no header bar, no menu bar...

Performance Analysis of Machine Learning Algorithms for Predicting Malware

Malware poses a persistent and evolving threat to modern computing systems, making accurate and timely detection a critical cybersecurity challenge. Traditional signature-based antivirus solutions often fail to identify newly emerging malware, leaving systems vulnerable until updated signatures...

On the Performance of Malware Detection Classifiers Using Hardware Performance Counters

Malware detection using Hardware Performance Counters HPC has emerged as a promising solution to improve the security of computing systems as a complement to antivirus software. Hardware-based malware detectors HMD use Machine Learning ML classifiers to detect malicious application patterns. The...

vet v1.18.1

Quick Start • Documentation • Community !NOTE vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository. Why vet? 70-90% of modern software is open source code — how do you know it's safe? Traditional SCA tools drown you in CVE...

vet v1.18.0

Quick Start • Documentation • Community !NOTE vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository. Why vet? 70-90% of modern software is open source code — how do you know it's safe? Traditional SCA tools drown you in CVE...

netwatch v0.28.1

NetWatch See what your network is actually doing — live, in your terminal. A network monitor that reads encrypted traffic, names the process behind every connection, and catches malware calling home. One binary. Zero config. Everything at once, withzero rows of chrome — no header bar, no menu bar...

Guarding Organizations against Malware Risk: A Novel Graph-Based Malware Detection Method

Organizational digitalization expands cybersecurity risks, making cybersecurity an increasingly important research area in Information Systems IS. Among these risks, malware has become a pervasive and destructive threat. Byte-based machine learning ML methods are widely used for malware detection...

netwatch v0.28.0

NetWatch See what your network is actually doing — live, in your terminal. A network monitor that reads encrypted traffic, names the process behind every connection, and catches malware calling home. One binary. Zero config. Everything at once, withzero rows of chrome — no header bar, no menu bar...

OGhidra — Updated!

OGhidra 3 - AI-Powered Reverse Engineering with Ghidra For the version using a Claude-inspired Orchestrator, see https://github.com/llnl/OGhidra/tree/orchestrator OGhidra bridges Large Language Models with Ghidra's reverse engineering platform, enabling AI-driven binary analysis through natural...

Taming the Security-Energy Paradox: A Green AI Approach to Optimized Android Malware Detection

An increase in advanced Android malware requires the use of deep learning models, which can run on Android devices. But there is a trade-off between security and energy use, as strong detection models can drain the battery of devices fast. This work tests different Multi-Layer Perceptron MLP mode...

Which Neurons Detect Malicious Code? A Probing Study of LLM Security Knowledge

Background. Large language models LLMs have become increasingly capable of understanding and generating source code, leading to their widespread adoption in software engineering tasks such as code completion, repair, and vulnerability detection. However, despite their strong empirical performance...

Leveraging Interpretable Tsetlin Machine for PDF Malware Detection

In the digital era, Portable Document Format PDF is one of the most widely used file formats for storing and exchanging digital documents due to its platform independence and rich functionality. However, these same capabilities have also made PDF files an attractive attack vector for...