416rehman/DeepZero

Find zero-days while you sleep. DeepZero is an automated vulnerability research framework that parses, decompiles, and analyzes thousands of Windows kernel drivers for exploitable IOCTLs natively using AI agents.

What it solves

DeepZero provides an automated pipeline engine for vulnerability research. It removes the manual effort of orchestrating complex security analysis workflows by allowing researchers to define a sequence of data ingestion, filtering, transformation, and LLM-based assessment stages in a declarative way.

How it works

Users define their analysis pipelines using YAML files. The engine handles the execution of these stages, managing parallelism via a ThreadPoolExecutor and maintaining an atomic per-sample state on disk. This ensures that if a process is interrupted, it can be resumed from where it left off. For AI-driven analysis, it integrates with various LLM providers through LiteLLM and uses Jinja2 for prompt templating.

Who it’s for

It is designed for security researchers and vulnerability analysts who need to scale their analysis of software (such as kernel drivers) and automate the repetitive parts of the data processing and assessment pipeline.

Highlights

  • Pipeline-as-YAML: Declaratively chain together ingestion, filtering, and LLM assessment stages.
  • Resumable Runs: Maintains state on disk to allow runs to pick up after a crash or manual interruption.
  • Parallel Execution: Configurable concurrency per stage to speed up processing.
  • LLM Integration: Supports any LLM provider via LiteLLM with flexible Jinja2 prompt templates.
  • Extensible Architecture: Allows users to write custom Python processors to expand the pipeline's capabilities.

Related

  • Project
    zenml-io/zenml

    ZenML is an open‑source MLOps platform that lets AI engineers define, version, and run pipelines (including LLM and agent workflows) on any infrastructure. It provides automatic containerisation, run tracking, integrations with MLflow/W&B/LangChain, a web dashboard, and a chat‑based query interface, all under an Apache‑2.0 license.

  • Project
    NVIDIA-NeMo/Skills

    A collection of pipelines for LLM development that streamlines synthetic data generation, training, and evaluation across local workstations and large-scale GPU clusters.

  • Project
    confident-ai/deepeval

    DeepEval is an open‑source Python framework that lets you write pytest‑style tests for any LLM‑based app—chatbots, agents, RAG pipelines, or multimodal generators. It ships with dozens of research‑backed metrics (e.g., G‑Eval, JevEval, task‑completion, hallucination, bias) that can run on any model locally, and you can add custom metrics. The library integrates with popular toolkits (LangChain, OpenAI, Anthropic, LlamaIndex, etc.) to automatically trace model calls, enabling both end‑to‑end and step‑level evaluation. Tests run from the CLI, fit into CI/CD, and can be linked to the commercial Confident AI platform for production‑time monitoring. Ideal for developers and teams who need quantitative quality gates for LLM applications.

  • Project
    confident-ai/deepteam

    DeepTeam is an open-source LLM red teaming framework that simulates adversarial attacks like jailbreaking and prompt injection to uncover vulnerabilities such as bias, data leakage, and SQL injection in AI agents, RAG pipelines, and chatbots. It runs locally, offers 50+ pre-built vulnerabilities, 20+ attack methods, and production guardrails.

  • Project
    ruc-datalab/DeepAnalyze

    DeepAnalyze is an open‑source, agentic LLM (8 B parameters) that can run the entire data‑science workflow—cleaning, analysis, modelling, visualisation, and report generation—without human intervention. The repository provides the model, a 500 K instruction dataset, and ready‑to‑run demos (Web UI, Jupyter UI, CLI) plus an OpenAI‑compatible API, all deployable via vLLM.