Daemon to ban hosts that cause multiple authentication errors

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

[archived] 一款实验性质的主机入侵检测系统

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.

By Kprobe technology Open Source Host-based Intrusion Detection System(HIDS), from E_Bwill.

A Linux Host-based Intrusion Detection System based on eBPF.

Hades is a Host-Based Intrusion Detection System based on eBPF(mainly)

A golang ebpf libary based on cilium/ebpf and datadog/ebpf.

GO开发而成，用于NIDS HIDS 分析的规则引擎，使用WorkerPool 高性能检测，支持多字段 "和" "或" 检测， 支持频率检测

Express security essentials deployment for Linux Servers

This tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources and lowest possible permissions to make it suitable for production server use.

Libellux: Up & Running provides documentation on how-to install open-source software from source. The focus is Zero Trust Network to enhance the security for existing applications or install tools to detect and prevent threats.

A HIDS (host-based intrusion detection system) for verifying the integrity of a system.

使用 cgroups + etcd + kafka + netlink-connector 开发而成的hids的架构，agent 部分使用go 开发而成， 会把采集的数据写入到kafka里面，由后端的规则引擎（go开发而成）消费，配置部分以及agent存活使用etcd。

ALPHA/WIP for OSquery configuration for Mac and Linux Operating Systems

一款linux下的安全产品目的是满足个人安全需求有SSH爆破防护和SYN攻击扫描防护功能,基于netfilter,

Scripts to deploy virtual testbed for log data analysis and anomaly detection.

A method for grouping, clustering, and merging semi-structured alerts

🚨an osquery powered, almost cross platform HIDS

Some of my security-related coding projects for OpenBSD: A kernel-based user-profile intrusion detection system (FUPIDS) and an ICMP-based "port-knocking" service (openportd).