New Slips version v1.1.23 is here!
Our team is excited to share the latest news and features of Slips, our behavioral-based machine learning intrusion detection system.
Quick links:
Download Slips from our GitHub repository: https://github.com/stratosphereips/StratosphereLinuxIPS
Access Slips documentation through Read the Docs: https://stratospherelinuxips.readthedocs.io/en/develop/
What We Are Particularly Excited About
In this release we are particularly excited about these new Slips features:
Add an LLM-powered Alert Summary module that generates natural-language analyst summaries of alerts, with historical context and memory across summaries.
Add a Regex Generator module that learns and validates regex signatures from traffic.
Add an LLM proxy module supporting Anthropic, OpenAI, and Ollama backends.
Add a T Cell module for immune-style detection: correlates evidence over time, tracks danger scores, and supports optional decision tracing and offline HTML reports.
Replace the `flow_ml_detection` module with two new modules, `ml_linear_model` and `ml_online_model`.
Split flow processing into a separate `conn_analyzer` module, so conn.Log analysis and flow alerting run as independent processes.
Add IDMEF-over-HTTPS exporting, allowing Slips to export each piece of evidence to a remote IDMEF server.
Rework Slips risk levels: risk now increases per timewindow based on a configurable risk weight, replacing the old bucket-based design.
Fix an ARP module memory leak and a bug detecting the attacker in MITM ARP attacks.
Fix problem stopping the evidence handler.
Fix Slips crashing on shutdown.
Fix problem starting the Redis cache database.
Fix a false positive where a known vendor showed as "unknown".
Fix password-guessing detection from `notice.Log`.
Fix problems handling disabled modules.
Fix problems sending Linux desktop notifications.
Fix the crash in the Wi-Fi interface lookup used for gateway MAC detection.
Fix stats/log text overlapping the printed live stats.
Fix problem using `--killall`.
Speed up module startup time.
Add a 7-day cooldown before adopting new pip library versions, to reduce supply-chain risk.
Warn when a module is disabled because its dependencies are missing.
Check the full list of changes in our release page: https://github.com/stratosphereips/StratosphereLinuxIPS/releases/tag/v1.1.23
Learn more!
Wondering what Slips is capable of? Check out these demo presentations:
LCN conference in 2021: https://youtu.be/1KqwlxVuf48
BlackHat USA Arsenal 2022: https://youtu.be/dJuTmi2bJcI
How to contribute
For those interested in contributing to Slips:
https://stratospherelinuxips.readthedocs.io/en/develop/contributing.html
https://www.stratosphereips.org/blog/2022/6/6/writing-a-slips-module
https://stratospherelinuxips.readthedocs.io/en/develop/slips_in_action.html
Get in Touch
Feel free to join our Discord server and ask questions, suggest new features or give us feedback. PRs and Issues are welcomed in our repo.