Llm Nids
C 68 completedPipeline State
completedPipeline Metadata
AI Prompt
Catalog Information
An LLM‑augmented network intrusion detection system that analyzes NetFlow data to identify and classify security threats using external intelligence and reasoning.
Description
This system processes NetFlow records to detect and classify network intrusions by combining external intelligence tools—IP geolocation, threat reputation, and MITRE ATT&CK mapping—with large‑language‑model reasoning. It uses a Model Context Protocol server to orchestrate these tools and generate context‑aware threat assessments and explanations. The solution is designed for security analysts and network engineers who need deeper insight into anomalous traffic patterns. It addresses the lack of actionable context in traditional NIDS by providing human‑readable explanations and prioritization. The project demonstrates how LLMs can enhance detection accuracy and operational efficiency.
الوصف
يعمل هذا النظام على تحليل سجلات NetFlow لتحديد وتصنيف التهديدات الأمنية باستخدام نماذج اللغة الكبيرة. يعتمد على أدوات خارجية مثل تحديد موقع العناوين IP، والتحقق من سمعة العناوين، ومطابقة سلوك الشبكة مع إطار MITRE ATT&CK. يدمج هذه البيانات مع استنتاجات معتمدة على الذكاء الاصطناعي لتقديم تقييمات مفصلة للتهديدات. يهدف النظام إلى مساعدة محللي الأمن على فهم السياق وتحديد أولويات التهديدات بسرعة. يحل مشكلة نقص التفسيرات الدقيقة في أنظمة كشف التسلل التقليدية. يميز نفسه بقدرة LLM على توضيح الأسباب وتقديم توصيات قابلة للتنفيذ.
Novelty
8/10Tags
Technologies
Claude Models
Quality Score
Strengths
- Good test coverage (53% test-to-source ratio)
- Consistent naming conventions (snake_case)
Weaknesses
- No LICENSE file \u2014 legal ambiguity for contributors
- No CI/CD configuration \u2014 manual testing and deployment
- 2 files with critical complexity need refactoring
- Potential hardcoded secrets in 2 files
- 1258 duplicate lines detected \u2014 consider DRY refactoring
- 3 'god files' with >500 LOC need decomposition
Recommendations
- Set up CI/CD (GitHub Actions recommended) to automate testing and deployment
- Add a linter configuration to enforce code style consistency
- Add a LICENSE file (MIT recommended for open source)
- Move hardcoded secrets to environment variables or a secrets manager
Security & Health
Languages
Frameworks
Concepts (2)
| Category | Name | Description | Confidence | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Repobility · code-quality intelligence · https://repobility.com | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| auto_description | Project Description | > A thesis project exploring LLM-augmented network intrusion detection using Model Context Protocol (MCP) and the CICIDS2018 dataset. | 80% | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| auto_category | Web Frontend | web-frontend | 70% | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Embed Badge
Add to your README:
