aiengine

AIEngine Artificial Inteligent Engine AIEngine is a next generation interactive/programmable Python/Ruby/Java/Lua packet inspection engine with capabilities of learning without any human intervention, NIDSNetwork Intrusion Detection System functionality, DNS domain classification, network...

NodeGoat

NodeGoat Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them. Getti...

malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide This project is intended to serve as reference when designing Cobalt Strike Malleable C2 profiles. Always verify your profile with ./c2lint /path/to/my.profile prior to use! Malleable C2 Profile Guidance The following dive deeper into the...

Custom-IDS--SentinelPyIDS-

SentinelPy IDS Author: Built by hannielcyber1 Se...

Beyond Model Scaling: Rethinking Sequence Construction for Transformer-Based Network Intrusion Detection

Transformer-based network intrusion detection systems NIDS have shown strong potential for detecting multi-stage cyberattacks, yet most methods construct input sequences using fixed temporalization schemes rather than treating sequence construction as a systems design decision. In flow-based...

Unmasking Shortcut Learning in IoT Intrusion Detection: A Forensic, Multi-Paradigm Evaluation of Feature Dependence and Data Leakage

Machine learning-based Network Intrusion Detection Systems often report near-perfect performance on IoT benchmarks. However, whether these models learn generalizable attack behavior or exploit spurious dataset shortcuts- such as static testbed IP/MAC addresses and chronological recording...

When Agents Look like Beacons: NIDS Evasion by Model Context Protocol Traffic

The Model Context Protocol MCP standardizes communication between autonomous Artificial Intelligence AI agents and remote tools over Streamable HTTP. This shift introduces a class of machine-generated, authenticated, and high-frequency JSON-RPC traffic directly into enterprise networks. Enterpris...

A Feature-Rich Embedded NIDS with EBPF/XDP: Detector and Architecture Trade-Offs

Distributed Denial-of-Service DDoS attacks remain a serious threat to transport networks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target. Recent work has yet to study the impact of the hosting software architecture on network monitoring...

A Three-Axis Stress Test of LLM Vs Classical ML for Network Intrusion Detection under Distribution Shift and Adversarial Evasion

Large language models are increasingly benchmarked against classical machine learning for network intrusion detection NIDS, almost always using same-dataset evaluation, and that protocol turns out to be incomplete. Evaluating XGBoost and RoBERTa-LoRA on two independently collected NetFlow v2...

CVE-2026-45761

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached...

CVE-2026-45752

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after i...

DEBIAN-CVE-2026-45763

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain L...

CVE-2026-45763

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain L...

CVE-2026-45763

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain L...

Privacy, Robustness, and Fairness Trade-Offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface

Federated learning enables privacy-conscious collaboration for network intrusion detection without centralizing sensitive traffic data, yet its deployment in operational environments must simultaneously satisfy three competing requirements: formal differential privacy guaranties, tolerance to...

Defending Network Intrusion Detection Systems Based on Graph Neural Networks against Structural Adversarial Attacks

Graph Neural Networks GNNs represent a promising solution for Machine Learning ML based Network Intrusion Detection Systems NIDS, thanks to their ability to leverage both network flow features and topological patterns. While GNN classifiers demonstrate superior robustness against feature-based...

Antiphishing v31032454195

DONATE - DASHBOARD VECTORS - CONTRIBUTING - SUBMIT A VECTOR - REST API CTI - WIKI Protect against phishing attacks Functionality This rule is built using malicious URLs and domains involved in phishing attacks. We utilize some community APIs and NRD Newly Registered Domain to construct these...

EX-NIDS: a Framework for Explainable Network Intrusion Detection Leveraging Large Language Models

This paper introduces eX-NIDS, a framework designed to enhance interpretability in flow-based Network Intrusion Detection Systems NIDS by leveraging Large Language Models LLMs. In our proposed framework, flows labelled as malicious by NIDS are initially processed through a module called the Promp...

Microsoft Internet Explorer CVE-2020-0640 Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Internet Explor...

Oracle PeopleSoft Enterprise PeopleTools Cpujan2020 Multiple Remote Security Vulnerabilities

Description Oracle PeopleSoft Enterprise PeopleTools is prone to multiple remote security vulnerabilities. These vulnerabilities can be exploited over the 'HTTP' protocol. These vulnerabilities affect the following supported versions: 8.56, 8.57 Technologies Affected Oracle PeopleSoft Enterprise...