{"id":1572,"date":"2024-09-01T12:00:38","date_gmt":"2024-09-01T12:00:38","guid":{"rendered":"https:\/\/abstractionslab.com\/?p=1572"},"modified":"2024-09-08T18:26:43","modified_gmt":"2024-09-08T18:26:43","slug":"alpha-release-of-idps-escape-on-1-sep-2024","status":"publish","type":"post","link":"https:\/\/abstractionslab.com\/index.php\/2024\/09\/01\/alpha-release-of-idps-escape-on-1-sep-2024\/","title":{"rendered":"Alpha release of IDPS-ESCAPE on 1 Sep. 2024"},"content":{"rendered":"\n

We have released the Alpha<\/strong> version of IDPS-ESCAPE on GitHub<\/a>.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Context<\/h2><\/div>\n\n\n\n

IDPS-ESCAPE, part of the CyFORT suite of open-source cybersecurity software solutions, addresses various aspects of cybersecurity as an ensemble, targeting different user groups, ranging from public to private and from CIRT\/CSIRT to system administrators. The design of IDPS-ESCAPE is targeted to cloud-native deployments, with an eye on CERT\/CSIRT-operated monitoring systems.<\/p>\n\n\n\n

Overview<\/h2><\/div>\n\n\n\n

IDPS-ESCAPE is aimed at closely capturing the notion of MAPE-K (Monitor, Analyze, Plan, Execute and Knowledge) from autonomic computing applied to cybersecurity, which translates into providing a comprehensive package fulfilling the roles of a Security Orchestration, Automation, and Response (SOAR) system, a Security Information and Event Management (SIEM), and an Intrusion Detection and Prevention System (IDPS), with a central subsystem dealing with anomaly detection (AD) based on state-of-the-art advances in machine learning (ML). We call this AD subsystem “ADBox<\/strong>“, which comes with out-of-the-box integration with well-known open-source solutions such as OpenSearch<\/a> for search and analytics, Wazuh<\/a> as our SIEM&XDR of choice, in turn connected to MISP<\/a> for enriching alerts, and to Suricata<\/a>, acting both as our network-based IDPS of choice, as well as a network-level data acquisition source.<\/p>\n\n\n\n

Our extensible ADBox<\/strong> framework and implementation, providing a modular and extensible software framework for efficiently integrating ML and AD algorithms, also include a Multivariate Time-series Anomaly Detection (MTAD) algorithm relying on Graph Attention Networks (GAT).<\/p>\n\n\n\n

In addition to providing security practitioners such as SOC operators or CTI analysts with anomaly detection over Wazuh indices (alerts, archives, statistics, etc.) in multiple modes (batch, real-time and historical), it can also be used to simplify and refine the work of security practitioners across several dimensions, e.g.,<\/p>\n\n\n\n