The official wepage of Slips is in: https://slips.stratosphereips.org/
Table of Contents
Slips: Behavioral Machine Learning-Based Intrusion Prevention System
Slips is a powerful endpoint behavioral intrusion prevention and detection system that uses machine learning to detect malicious behaviors in network traffic. Slips can work with network traffic in real-time, PCAP files, and network flows from popular tools like Suricata, Zeek/Bro, and Argus. Slips threat detection is based on a combination of machine learning models trained to detect malicious behaviors, 40+ threat intelligence feeds, and expert heuristics. Slips gathers evidence of malicious behavior and uses extensively trained thresholds to trigger alerts when enough evidence is accumulated.
Introduction
Slips is the first free software behavioral machine learning-based IDS/IPS for endpoints. It was created in 2012 by Sebastian Garcia at the Stratosphere Laboratory, AIC, FEE, Czech Technical University in Prague. The goal was to offer a local IDS/IPS that leverages machine learning to detect network attacks using behavioral analysis.
Slips is supported on Linux, MacOS, and windows dockers only. The blocking features of Slips are only supported on Linux
Slips is Python-based and relies on Zeek network analysis framework for capturing live traffic and analyzing PCAPs. and relies on
Redis >= 7.0.4 for interprocess communication.
Usage
The recommended way to use Slips is on Docker.
Linux and Windows hosts
docker run --rm -it -p 55000:55000 --cpu-shares "700" --memory="8g" --memory-swap="8g" --net=host --cap-add=NET_ADMIN --name slips stratosphereips/slips:latest
./slips.py -f dataset/test7-malicious.pcap -o output_dir
cat output_dir/alerts.log
Macos
In MacOS, do not use --net=host if you want to access the internal container's ports from the host.
docker run --rm -it -p 55000:55000 --platform linux/amd64 --cpu-shares "700" --memory="8g" --memory-swap="8g" --cap-add=NET_ADMIN --name slips stratosphereips/slips_macos_m1:latest
./slips.py -f dataset/test7-malicious.pcap -o output_dir
cat output_dir/alerts.log
For more installation options
For a detailed explanation of Slips parameters
Graphical User Interface
To check Slips output using a GUI you can use the web interface. An optional
Kalipso checkout is also available as the modules/kalipso submodule for the
terminal interface.
Web interface
./slips.py -e 1 -f dataset/test7-malicious.pcap -w
Then navigate to http://localhost:55000/. The interface is read-only, localhost-only, and fixed to this run's Redis database, SQLite flow database, and output logs. It shows runtime and module health, alerts, all evidence, triggering flows, and host context. It can also be enabled with web_interface.enabled: true in config/slips.yaml.
For more info about the web interface, check the docs: https://stratospherelinuxips.readthedocs.io/en/develop/usage.html#the-web-interface
Kalipso submodule
Kalipso is maintained in a separate repository and included here as an optional
submodule:
git submodule update --init --recursive modules/kalipso
See the installation docs for native setup details.
Requirements
Slips requires Python 3.12.3 and at least 4 GBs of RAM to run smoothly.
Installation
Slips can be run on different platforms, the easiest and most recommended way if you're a Linux user is to run Slips on Docker.
Configuration
Slips has a config/slips.yaml that contains user configurations for different modules and general execution.
Do not edit the default config/slips.yaml directly. Create a copy for your local configuration changes and run Slips with -c, for example ./slips.py -c config/my_slips.yaml -f dataset/test7-malicious.pcap.
The same applies to config/whitelist.conf: keep the default file unchanged, create a copy, and set whitelists.local_whitelist_path in your copied Slips config file to point to your copied whitelist file.
Slips aborts updating to new versions when there are changes to Slips local config files.
-
You can change the timewindow width by modifying the time_window_width parameter
-
You can change the analysis direction to all if you want to see the attacks from and to your computer
-
You can also specify whether to train or test the ML models
-
You can enable popup notifications of evidence, enable blocking, plug in your own zeek script and more.
-
The t_cell section is enabled by default so Slips can consume centrally tagged PAMP and DAMP evidence, match extracted antigens against accepted regexes, and then carry a signal-specific priming profile into later co-stimulation and context decisions. DAMP can now create a weaker state-1 cell with stricter later thresholds and a shorter waiting window, while all responder state stays in its own SQLite DB.
More details about the config file options here
Features
Slips key features are:
- Behavioral Intrusion Prevention: Slips acts as a powerful system to prevent intrusions based on detecting malicious behaviors in network traffic using machine learning.
- Modularity: Slips is written in Python and is highly modular with different modules performing specific detections in the network traffic.
- Targeted Attacks and Command & Control Detection: It places a strong emphasis on identifying targeted attacks and command and control channels in network traffic.
- Traffic Analysis Flexibility: Slips can analyze network traffic in real-time, PCAP files, and network flows from popular tools like Suricata, Zeek/Bro, and Argus.
- Threat Intelligence Updates: Slips continuously updates threat intelligence files and databases, providing relevant detections as updates occur.
- HTTPS Anomaly Detection: Adaptive TLS/HTTPS anomaly detection with drift handling and a local HTML report generator for deep dives.
- Integration with External Platforms: Modules in Slips can look up IP addresses on external platforms such as VirusTotal and RiskIQ.
- Graphical User Interface: Slips provides a web interface and an optional Kalipso terminal interface through the
modules/kalipso submodule.
- Shared LLM Access: Slips can expose configured LLM backends such as Ollama, OpenAI, and Anthropic to other modules through Redis channels.
- Hierarchical Alert Summaries: Slips can turn correlated alert evidence into analyst-facing one-paragraph incident summaries, recursively reducing oversized evidence sets instead of truncating them.
- Pseudo-Random Regex Generation: Slips can generate and validate pseudo-random regexes for DNS domains, URIs, filenames, TLS SNI, and certificate CN fields for later Zeek-side use.
- Immune-Style T Cell Response: Slips can consume centrally tagged
PAMP and DAMP evidence, correlate extracted antigens with accepted regexes, and use signal-specific T-cell priming plus mixed PAMP/DAMP danger pressure to decide whether to stay tolerant, activate, contain, or store long-term memory.
- Peer-to-Peer (P2P) Module: Slips includes a complex automatic system to find other peers in the network and share IoC data automatically in a balanced, trusted manner. The P2P module can be enabled as needed.
- Docker Implementation: Running Slips through Docker on Linux systems is simplified, allowing real-time traffic analysis.
- Detailed Documentation: Slips provides detailed documentation guiding users through usage instructions for efficient utilization of its features.
Contributing
We welcome contributions to improve the functionality and features of Slips.
Please read carefully the contributing guidelines for contributing to the development of Slips
You can run Slips and report bugs, make feature requests, and suggest ideas, open a pull request with a solved GitHub issue and new feature, or open a pull request with a new detection module.
The instructions to create a new detection module along with a template here.
If you are a student, we encourage you to apply for the Google Summer of Code program that we participate in as a hosting organization.
Check Slips in GSoC2023 for more information.
You can join our conversations in Discord for questions and discussions.
We appreciate your contributions and thank you for helping to improve Slips!
Documentation
User documentation
T Cell design and configuration: docs/t_cell_module.md
T Cell offline report generation and interpretation:
docs/t_cell_module.md#offline-html-report
Code docs
Troubleshooting
If you can't listen to an interface without sudo, foe example when zeek is throwing the following error:
fatal error: problem with interface wlan0 (pcap_error: socket: Operation not permitted (pcap_activate))
you can adjust zeek capabilities using the following command
sudo setcap cap_net_raw,cap_net_admin=eip /<path-to-zeek-bin/zeek
You can join our conversations in Discord for questions and discussions.
Or email us at
License
GNU General Public License
Credits
Founder: Sebastian Garcia, [email protected], [email protected].
Main authors: Sebastian Garcia, Alya Gomaa, Kamila Babayeva
Contributors:
Changelog
https://github.com/stratosphereips/StratosphereLinuxIPS/blob/develop/CHANGELOG.md
Demos
The following videos contain demos of Slips in action in various events:
- 2022 BlackHat Europe Arsenal, Slips: A Machine-Learning Based, Free-Software, Network Intrusion Prevention System [web]
- 2022 BlackHat USA Arsenal, Slips: A Machine-Learning Based, Free-Software, Network Intrusion Prevention System [web]
- 2021 BlackHat Europe Arsenal, Slips: A Machine-Learning Based, Free-Software, Network Intrusion Prevention System [slides] [web]
- 2021 BlackHat USA Arsenal, Slips: A Machine-Learning Based, Free-Software, Network Intrusion Prevention System [web]
- 2021 BlackHat Asia Arsenal, Slips: A Machine-Learning Based, Free-Software, Network Intrusion Prevention System [web]
- 2020 Hack In The Box CyberWeek, Android RATs Detection With A Machine Learning-Based Python IDS [video]
- 2019 OpenAlt, Fantastic Attacks and How Kalipso can Find Them [video]
- 2016 Ekoparty, Stratosphere IPS. The free machine learning malware detection [video]
Funding
We are grateful for the generous support and funding provided by the following organizations:
This project is funded through NGI0 Entrust, a fund established by NLnet with financial support from the European Commission's Next Generation Internet program. Learn more at the NLnet project page.
Their funding has played a crucial role in the development and success of this project.
We sincerely appreciate their commitment to advancing technology and their recognition of
the value Slips brings to the community.
