StratosphereLinuxIPS
Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic.
What is StratosphereLinuxIPS?
Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.
Overview of StratosphereLinuxIPS
What it is
Slips (StratosphereLinuxIPS) is a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in network traffic. It was created in 2012 by Sebastian Garcia at the Stratosphere Laboratory, AIC, FEE, Czech Technical University in Prague. Slips is supported on Linux, macOS, and Windows (Docker only). Blocking features are only supported on Linux. It is Python-based and relies on Zeek for traffic capture and analysis, and Redis >= 7.0.4 for interprocess communication.
Key features
- Behavioral intrusion prevention using machine learning to detect malicious behaviors in network traffic.
- Modular design with different modules performing specific detections.
- Traffic analysis flexibility: real-time, PCAP files, and network flows from Suricata, Zeek/Bro, and Argus.
- Continuous threat intelligence updates from 40+ feeds.
- Adaptive TLS/HTTPS anomaly detection with drift handling and local HTML report generation.
- Peer-to-peer (P2P) module to automatically find other peers and share IoC data in a balanced, trusted manner.
- Docker implementation for simplified deployment on Linux systems.
Use cases
Slips is used for behavioral intrusion prevention and detection, analyzing network traffic to identify malicious behaviors, targeted attacks, and command and control channels. It can be used in real-time monitoring, offline PCAP analysis, and integration with existing network flow tools.
Getting started
The recommended way to use Slips is on Docker. For Linux and Windows hosts: docker run --rm -it -p 55000:55000 --cpu-shares 700 --memory=8g --memory-swap=8g --net=host --cap-add=NET_ADMIN --name slips stratosphereips/slips:latest Then analyze a PCAP file: ./slips.py -f dataset/test7-malicious.pcap -o output_dir cat output_dir/alerts.log For the web interface: ./slips.py -e 1 -f dataset/test7-malicious.pcap -w Then navigate to http://localhost:55000/.
License and pricing
Slips is open source under the GPL-2.0 license. Pricing is not stated; it is free software.
Based on the project's public README and repository metadata.
