Machine Learning, Python, Slips, Stratosphere Linux IPS
Stratosphere IPS
HTTPS Anomaly Detection in Slips: Adaptive ...

The new HTTPS anomaly detection module in Slips builds per-host adaptive baselines in traffic time, then detects deviations at two levels: per-flow (for bytes to known servers) and per-hour (for host behavior like new servers, unique servers, JA3 changes, and flow volume). It uses online statistics and z-scores for transparent scoring, plus controlled adaptation states (training_fit, drift_update, suspicious_update) to keep learning while reducing poisoning risk.
The result is explainable, operational evidence in clear human text: what changed, confidence, and why it is anomalous.

HTTPS Anomaly Detection in Slips: Adaptive Baselines for Real Traffic
Education, publications, Python, Slips, Stratosphere Linux IPS
Stratosphere IPS
Rethinking Cybersecurity Defense: Principles ...

Our research identifies sixteen fundamental principles of biological immunity and translates them into cybersecurity defense architectures that emphasize multi-dimensional coordination over single- point tactics.

Rethinking Cybersecurity Defense: Principles from Biological Immunity
Maria Rigaki
AI Attackers in Your Pocket: How Small Language ...

We are pleased to announce the publication of our latest paper, “Building adaptive and transparent cyber agents with local language models,” in the Journal of Expert Systems with Applications.

Slips
Stratosphere IPS
How Well Do LLMs Perform on a Raspberry Pi 5?

Can a Raspberry Pi 5 run Large Language Models? In this post, we share the results of our experiments, analyzing how LLMs perform on this low-cost hardware and exploring the challenges and performance trade-offs.

How Well Do LLMs Perform on a Raspberry Pi 5?
Stratosphere IPS
Introducing ARACNE, a new LLM-based shell ...

The complete automation of cyber-attacks has become one of the areas of greatest interest since the introduction of Large Language Models (LLMs) to the public. The creation of attacking LLM agents that can act independently is among the most popular options. 

In this blog, we introduce a brand-new agent: ARACNE. We also share the results of attack tests and what they mean in terms of the agent’s current capabilities.

Introducing ARACNE, a new LLM-based shell pentesting agent

analysis

Active Scanning for SAP Applications

By analyzing the activity/traffic of a large network, it is possible to spot scanning attempts potentially performed by threat actors. Scanning for the SAP NetWeaver JAVA default port increased significantly after the release of the patch for the RECON vulnerability.

IoT Malware Analysis Series. An IoT malware dropper with custom C&C channel exploiting HNAP

IoT Malware Analysis Series. An IoT malware dropper with custom C&C channel exploiting HNAP

On February 28th, 2019 we infected one of our devices with the malware sample that most AV detect as Mirai. However, it was a bash script downloader that obtains and exacute an ARM ELF binary to attack others using the HNAP vulnerability in order to infect new bots.

ANALISIS OF CTU-MALWARE-CAPTURE-1 (ZBOT.OOWO)

ANALISIS OF CTU-MALWARE-CAPTURE-1 (ZBOT.OOWO)

CTU-MALWARE-CAPTURE-1 (ZBOT.OOWO)

This capture was done between Thu Sep  5 15:40:07 CEST 2013 and Tue Oct  1 13:38:29 CEST 2013, having a total of 25 days and 21 hours. It corresponds to a binary with the MD5 46b3df3eaf1312f80788abd43343a9d2 of and that was classified by Kaspersky in VirusTotal as Trojan-Spy.Win32.Zbot.oowo. However we are not sure of the name.

Protecting the civil society through high quality research