Slips is an open-source, machine-learning-based system for detecting and preventing network attacks on endpoints, written in Python. It analyses live network traffic, pcap files and flows from Suricata, Zeek and Argus, accumulates evidence of suspicious behaviour and raises an alert once enough has built up. It focuses on targeted attacks and command-and-control traffic and includes a local web interface for alerts, evidence and flows. Docker is the recommended way to install it; blocking works on Linux only.
Slips has been developed since 2013 by the Stratosphere Laboratory at the Czech Technical University in Prague, in the Czech Republic. The source code is published on GitHub under the GPL-2.0. You run the software on your own systems, so traffic data stays under your control; the project does not offer a cloud service of its own. Optional modules can export data, for example to Slack or STIX servers. A follow-up project for a distributed variant is funded through NLnet's NGI0 Commons Fund.