Intrusion Detection Python Packages

idstools

idstools: Snort and Suricata Rule and Event Utilities in Python (Including a Rule Update Tool)

cnsl

Security Layer CNSL Brain

fgex

Firegex, a firewall for Attack-Defense CTFs

firegex

Firegex, a firewall for Attack-Defense CTFs

pysad

Streaming anomaly detection in Python: 16 online detectors (xStream, LODA, RS-Hash, Half-Space Trees, RRCF…) plus calibration and prequential evaluation for real-time data.

vigia-nids

Quality control for the datasets behind network intrusion detection models: leakage, duplicates, label noise, poisoning and drift.

picosnitch

Monitor network traffic per executable

vamp-arp-sentinel

VampSecure Labs: ARP spoofing detector + PoC lab (Scapy + Rich)

acrawriter

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

ids-rule-converter

Translate Snort and Suricata rules without losing what they mean. A fail-safe, engine-tested IDS conversion and analysis toolkit.

pyhids

A HIDS (host-based intrusion detection system) for verifying the integrity of a system.

isconna

Python porting of the Isconna algorithm.

aegis5

Aegis-5: Adaptive hybrid ensemble framework for intrusion detection in Industry 5.0 — ACM TAAS 2026

unavoids

Official repo of the article: W. A. Yousef, I. Traoré and W. Briguglio, "UN-AVOIDS: Unsupervised and Nonparametric Approach for Visualizing Outliers and Invariant Detection Scoring," in IEEE Transactions on Information Forensics and Security, vol. 16, pp. 5195-5210, 2021, doi: 10.1109/TIFS.2021.3125608.

graphids

Graph-based cloud intrusion detection using GCN, Transformer autoencoder, and contrastive learning — Scientific Reports 2025

pcap2tensor

PCAP → ML tensor extraction for network intrusion detection research.