semvec/pypi-packages huggingface dataset:
AutoZeekWatch 0.1.3
Network Intrusion Detection using Zeek logs
License: MIT
Requires Python: >=3.6

# AutoZeekWatch

AutoZeekWatch is a real-time, modular, configurable A.I. anomaly detector for [Zeek](https://zeek.org/) logs. AutoZeekWatch enables you to generate anomaly scores for Zeek logs im real time, and correlate them with the initial 5-tuple and Zeek UID for downstream analysis, automated mitigation, and more. 

## Table of Contents

* Features
* Installation
* Examples

## Features

AutoZeekWatch functions in two distinct phases, **training** and **inference**. Under the hood, [KitNET](https://pysad.readthedocs.io/en/latest/generated/pysad.models.KitNet.html), a ensemble of autoencoders, is used to generate anomaly scores for individual logs in a unsupervised manner. 

During **training**, the model must learn the *normal* distribution from provided data. The user is expected to provide a directory where historical, *normal* (not malicious) logs are stored. The model then learns this distribution. 

During **inference**, the model provides a score of how anomalous a given log is to the distribution learned from training. This score along with the 5-tuple (Source IP, Destination IP, Source Port, Destination Port, Proto) is then dumped to a file which can be used for downstream tasks or alerting. 

It is possible to specify different zeek log types to train on and perform inference on. Currently, the following are available:

- Connection
- HTTP
- DNS
- SSH
- SSL

These can be used modularly, one, many, or all can be used at once. 

## Installation

...

## Examples

### Train a Model on Connection Data

```
python train.py --log-dir <PATH/TO/LOGS> --modules CONN
```

### Start Inference on Incoming Connection Data

```
python infer.py --log-dir <PATH/TO/LOGS> --modules CONN
```
dovekie 0.7.0
A library that defines common SKI combinators from Combinatory Logic.
License: MIT
Requires Python: >=3.6

# <p align="center">`dovekie`</p>

<p align="center">
    <a href="https://github.com/codereport/dovekie/issues" alt="contributions welcome">
        <img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat" /></a>
    <a href="https://lbesson.mit-license.org/" alt="MIT license">
        <img src="https://img.shields.io/badge/License-MIT-blue.svg" /></a>    
    <a href="https://www.python.org/">
        <img src="https://img.shields.io/badge/Python-3-ff69b4.svg"/></a>
    <a href="https://github.com/codereport?tab=followers" alt="GitHub followers">
        <img src="https://img.shields.io/github/followers/codereport.svg?style=social&label=Follow" /></a>
    <a href="https://GitHub.com/codereport/dovekie/stargazers/" alt="GitHub stars">
        <img src="https://img.shields.io/github/stars/codereport/dovekie.svg?style=social&label=Star" /></a>
    <a href="https://twitter.com/code_report" alt="Twitter">
        <img src="https://img.shields.io/twitter/follow/code_report.svg?style=social&label=@code_report" /></a>
</p>

`dovekie` is a [Python](https://www.python.org/) library that provides SKI combinators from [Combinatory Logic](https://combinatorylogic.com/) and common unary and binary functions that are often used with these combinators. It is the spiritual equivalent of the:

* C++ [`blackbird` library](https://github.com/codereport/blackbird)
* Rust [`bluebird` library](https://github.com/codereport/bluebird)

<p align="center">
  <img src="https://github.com/codereport/dovekie/assets/36027403/3a51f52e-165c-40e0-a3e0-6318915cef8f" alt="image-removebg-preview">
</p>

How to install:
```bash
pip3 install dovekie
```

And how to use:
```py
import operator as op
from itertools import accumulate

import dovekie as dk


def mco(xs: list[int]) -> int:
    return max(accumulate(xs, dk.phi1(op.add, op.mul, dk.r)))

print(mco([1, 0, 1, 1, 1, 0, 0, 1, 1, 0])) # 3
```