Cyber Analytics Lab

BinOct

Binary Programming Formulation for Learning Classification Trees Using Cplex

DNS channel detection

DNS storage channel detection written by Sven van Hal for his MSc thesis project. It contains several new datasets of malicious channels and a detector based on random forests and isolation forests.

Flexfringe

Flexfringe is a tool for learning finite state machines, also known as deterministic finite automata. It brings common merge heuristics such as alergia, EDSM, likelihood-ratio, and others, but also offers a flexible interface to easily add custom merge heuristics.

GROOT

Fast learning of adversarially robust decision trees and forests

MalPaCA

MalPaCA clusters similar-behaving network connections using Dynamic Time Wapring and N-grams. It takes a Pcap file as input and generates clusters based on behavioral differences. The output is given as a DAG and temporal heatmaps.

SAGE

SAGE is an alert-driven attack graph generator. It takes intrusion alerts as input (preferably in a json format) and produces attack graphs on a per-objective, per victim basis.

SECLEDS

SECLEDS is a streaming variant of the k-medoids clustering algorithm, especially designed for sequence clustering.

TABOR

TABOR is an intrusion detection system based on RTI+ for learning timed automata capturing sequential behavior and Bayesian Networks capturing correlations between signals.