stratosphereips/StratosphereLinuxIPS

What it solves

Slips is an endpoint behavioral intrusion prevention and detection system (IPS/IDS) designed to identify malicious network traffic. It specifically targets the detection of targeted attacks and command-and-control (C2) channels that might bypass traditional security tools.

How it works

Slips uses a combination of machine learning models, over 40 threat intelligence feeds, and expert heuristics to analyze network traffic. It integrates with the Zeek network analysis framework to capture live traffic or process PCAP files and network flows from tools like Suricata and Argus. The system gathers evidence of malicious behavior and triggers alerts based on trained thresholds.

Who it’s for

Security analysts and system administrators who need a free, open-source behavioral analysis tool for endpoint protection on Linux, MacOS, and Windows (via Docker).

Highlights

• Behavioral ML Detection: Uses machine learning to detect malicious patterns rather than relying solely on signatures.
• Multimodal Analysis: Supports real-time traffic, PCAP files, and network flows.
• LLM Integration: Can expose LLM backends (Ollama, OpenAI, Anthropic) to generate hierarchical alert summaries for analysts.
• Immune-Style Response: Implements a "T Cell" module that mimics biological immune responses to decide whether to activate, contain, or store memory of a threat.
• P2P Threat Sharing: Includes a module for peers in a network to automatically share Indicators of Compromise (IoC) data.
• C2 Detection: Strong emphasis on identifying command and control channels and HTTPS anomalies.