416rehman/DeepZero

Find zero-days while you sleep. DeepZero is an automated vulnerability research framework that parses, decompiles, and analyzes thousands of Windows kernel drivers for exploitable IOCTLs natively using AI agents.

What it solves

DeepZero provides an automated pipeline engine for vulnerability research. It removes the manual effort of orchestrating complex security analysis workflows by allowing researchers to define a sequence of data ingestion, filtering, transformation, and LLM-based assessment stages in a declarative way.

How it works

Users define their analysis pipelines using YAML files. The engine handles the execution of these stages, managing parallelism via a ThreadPoolExecutor and maintaining an atomic per-sample state on disk. This ensures that if a process is interrupted, it can be resumed from where it left off. For AI-driven analysis, it integrates with various LLM providers through LiteLLM and uses Jinja2 for prompt templating.

Who it’s for

It is designed for security researchers and vulnerability analysts who need to scale their analysis of software (such as kernel drivers) and automate the repetitive parts of the data processing and assessment pipeline.

Highlights

  • Pipeline-as-YAML: Declaratively chain together ingestion, filtering, and LLM assessment stages.
  • Resumable Runs: Maintains state on disk to allow runs to pick up after a crash or manual interruption.
  • Parallel Execution: Configurable concurrency per stage to speed up processing.
  • LLM Integration: Supports any LLM provider via LiteLLM with flexible Jinja2 prompt templates.
  • Extensible Architecture: Allows users to write custom Python processors to expand the pipeline's capabilities.

Related

  • Project
    zenml-io/zenml

    An open-source MLOps platform that orchestrates the full lifecycle of AI pipelines and agents, from development to production deployment.

  • Project
    NVIDIA-NeMo/Skills

    A collection of pipelines for LLM development that streamlines synthetic data generation, training, and evaluation across local workstations and large-scale GPU clusters.

  • Project
    confident-ai/deepeval

    An open-source LLM evaluation framework that provides unit-testing capabilities for AI agents, RAG pipelines, and chatbots using LLM-as-a-judge metrics.

  • Project
    confident-ai/deepteam

    An open-source red teaming framework for LLM systems that simulates adversarial attacks to uncover vulnerabilities and provides guardrails for production security.

  • Project
    ruc-datalab/DeepAnalyze

    An agentic LLM designed for autonomous data science, capable of automating the entire pipeline from data preparation to the generation of professional research reports.