Est. 2013 — Stratosphere Laboratory, Czech Technical University in Prague
Slips:
behavioral detection
Slips is the first free software behavioral machine learning-based IDS/IPS for endpoints. It reads input traffic, accumulates evidence until it triggers an alert. Can ingest live traffic, pcaps, Zeek, Suricata, Argus, and more.
How Slips decides
Models
Machine learning trained on malicious behavior over time windows. It catches targeted attacks and command-and-control channels that match nothing known.
Intel
40+ threat intelligence feeds, updated continuously. Modules can also pull context from VirusTotal and RiskIQ.
Heuristics
Expert rules where models fall short, including adaptive TLS/HTTPS anomaly detection with drift handling.
Quick start
One command.
Docker is the recommended way to run Slips. Needs Python 3.10.12 and 4 GB of RAM. Blocking features are Linux-only.
$ docker run --rm -d --net=host --cap-add=NET_ADMIN --name slips stratosphereips/slips:latest bash -c 'redis-server --daemonize yes && exec ./slips.py -i <interface> -w -o output'
On macOS, do not use --net=host if you want to access the container's internal ports from the host.
Built to be extended
One module, one detection
Python end to end, with a documented template for adding your own detection to the pipeline.
Peers that share indicators
Find other peers on the network and trade IoCs in a balanced, trusted manner. Optional.
Learning without pooling
Federated training across endpoints through the feel_project submodule.
Browser or terminal
Run with -w for the web interface on port 55000, or use Kalipso in the terminal.
Yours to tune
Time window width, analysis direction, train or test the models, plug in your own Zeek script.
Issues, PRs, GSoC
Report bugs, request features, or apply through Google Summer of Code — we host as an organisation.
On stage
Bring a
detection idea.
Slips is GPL-2.0 free software. Read the contributing guidelines, then open an issue, a pull request, or a whole new module.
Main authors Sebastian Garcia, Alya Gomaa
+ Kamila Babayeva, Veronica Valeros, Frantisek Strasak, Dita Hollmannova, Ondřej Lukáš, Elaheh Biglar Beigi, Martin Řepa, arkamar, Maria Rigaki, Lukas Forst, Daniel Yang, Jan Sbovoda, David Otta
Supported by
Slips exists
because of them.
We are grateful for the generous support and funding provided by these organizations. Their commitment to advancing technology, and their recognition of the value Slips brings to the community, has been crucial to the project.