IDS

• Midas
  MIDAS is a cross platform Monitoring and NIDS server. The goal of this project is to build a robust and complete network/system monitoring suite that is capable of scaling to very large networks. ...
  
• logcheck, logsentry
  The Sentry tools provide host-level security services for the Unix platform. PortSentry, Logcheck/LogSentry, and HostSentry protect against portscans, automate log file auditing, and detect suspiciou...
  
• labrea
  Intrusion detection / "sticky" honey pot technology using virtual servers to detect and trap worms, hackers, and other malware. ...
  
• Claymore
  Claymore is an intrusion detection and integrity monitoring system. To accomplish its task, it reads in a list of files stored in flat ASCII and uses Digest::MD5 to check their integrity against that...
  
• Logscan.py
  Logscan is a tool to assist in generating complaint emails in response to security probes or attacks. Logscan scans through logs looking for patterns and if certain thresh-holds are reached it sends ...
  
• Prelude
  IDS which includes Network IDS, "host based" IDS. You can add modules, different platforms are supported, web-based GUI. And many more... ...
  
• LIDS
  A kernel patch to enhance the linux kernel security. ...
  
• SID-IDS
  SID-IDS is a host intrusion detection system. The kernel part plugs into a terminal-processing subsystem and logs hashed terminal lines. The user part reads log entries (hashes) and takes appropriate...
  
• Integrit
  Integrit is a more simple alternative to file integrity verification programs like tripwire and aide. It helps you determine whether an intruder has modified a computer system. ...
  
• Firestorm
  Firestorm is an extremely high performance network intrusion detection system (NIDS) ...
  
• Dnotify
  Dnotify is a simple program that makes it possible to execute a command every time the contents of a specific directory change in linux. It is run from the command line and takes two arguments: one o...
  
• glFlow
  glFlow is a (D)DoS logger written with speed in mind. It detects attacks on high speed links through real-time flow aggregation and analysis. ...
  
• ImSafe
  ImSafe (Immune Security For your Enterprise) is a host-based intrusion detection tool. After a learning phase, it is able to detect changes in processes behavior, to detect buffer overflows, etc. It ...
  
• CodeSeeker
  CodeSeeker is an application level firewall and intrusion detection system that is not a packet proxy, but rather a plugin to the TCP stack itself. ...
  
• Placid
  Placid is a Web-based frontend for Snort that uses MySQL. It supports searching, sorting, and graphing of events. ...
  
• Nift
  Nift - (Network Intrusion Footprinting Tool) is graphical front-end (written in gtk+) for footprinting tools and methods already freely avaliable. It's purpose is to aid sys-admins in securing their ...
  
• SIDEN
  SIDEN is a distributed network discovery tool used for intrusion detection research. The current SIDEN architecture allows you to simulate coordinated/distributed network probes by a group of attacke...
  
• check-ps
  Devialog is a behavior/anomaly-based syslog intrusion detection system which detects unknown attacks via anomalies in syslog. ...
  
• ICU
  ICU (Integrity Checking Utility) is a Perl program used for executing AIDE filesystem integrity checks on remote hosts from an ICU server and sending reports via email. ...
  
• FCheck
  An open source PERL script providing intrusion detection and policy enforcement of Windows 95/98/NT/3.x and Unix server administration through the use of comparative system snapshots. ...
  
• SPADE
  This is the resurrection of the SPADE project originally conceived by Silicon Defence. The SPADE project statistically analyses packets on a network to determine if they are "normal" or "not normal" ...
  
• I-AM-DOH
  IAMDOH is a tool designed to increase the reliability of an IDS by reducing the number of false positives. It uses existing reliable tools like Nmap, Nessus, and Amap to validate IDS alerts. ...
  
• rdetect
  ...
  

1