apt-detection

A lightweight **Linux endpoint** detection agent written in **Go**. It runs as a CLI or **systemd** service, scans the host on an interval (and optionally watches `authorized_keys` via **fsnotify**), and emits **one JSON object per line** on stdout for SIEM pipelines.

☠️ rupurt — Advanced Linux rootkit hunter | 250+ signatures, eBPF kernel analysis, memory forensics, APT detection | NullSec

Lightweight Endpoint Detection & Response (EDR) Framework

Host Intrusion Detection & Active Signaling System (HIDASS) for Linux kernel 5.15+. Implements a Stackelberg defender-leader game-theoretic model to expose interactive APTs via eBPF-driven TTY timing analysis (Welford/Shannon entropy) and adaptive zero-copy RingBuffer jitter injection. Built in Rust (no_std probe, Tokio user-space daemon).

Personal Knowledge Base & Technical Research Hub by Ahmed BARGADY (AI Engineer & PhD Student @ UM6P). Comprehensive mathematical derivations, PyTorch/DGL code implementations, APT threat detection syntheses (GNNs & Provenance Graphs), and Agentic GraphRAG system architectures.

Codes and data for USENIX Security 24 paper "MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning"

AI-powered Advanced Persistent Threat (APT) detection system built on the ELK Stack.

The WPF-based graphical user interface for interacting with MAGIC - Detecting Advanced Persistent Threats via Masked Graph Representation Learning

Windows 기반 APT 공격 실시간 탐지 및 대응 자동화 시스템

Autonomous multi-agent DFIR orchestrator — Splunk alerts trigger AI triage, findings pushed back to Splunk. 100% precision, 0 hallucinations. Claude + SIFT + Go MCP Server.

AI-powered intrusion detection and APT attack prediction system using FastAPI, XGBoost and explainable AI.

Research framework proposing a standardized reproducibility protocol and the Integrated Operational Utility Score (IOUS) for evaluating provenance based APT detection systems.