Awesome-AI-for-cybersecurity - Awesome list of AI for cybersecurity including net

项目说明

Awesome AI for cybersecurity

This is a list of AI for cybersecurity, including network (network traffic analysis and intrusion detection), endpoint (anti-malware), application (WAF or database firewalls), user (UBA), process behavior (anti-fraud).

1. Introduction

First, beginners should look at machine learning tasks and its applications. I wrote a machine learning blog including CV (CNN, GAN), RL, GNN, NLP.

Additionally, de still need to know more about security/cybersecurity, here is the awesome list of security tool and knowledge.

Then, let's turn to AI for cybersecurity.

The first dimension is a goal or a task. According to Gartner’s PPDR model, all security tasks can be divided into fi:

prediction

pre

detection

response

monitoring

The second dimension is a technical layer and the list of layers for this dimension:

network (network traffic analysis and intrusion detection)

endpoint (anti-malware)

application (WAF or database firewalls)

user (UBA)

process behavior (anti-fraud)

2. Network Protection

ML in network security implies new solutions called Network Traffic Analytics (NTA) aimed at in-depth analysis of all the traffic at each layer and detect attacks and anomalies.

How can ML help here? There are some examples:

regression to predict the network packet parameters and compare them with the normal ones;

classification to identify different classes of network attacks such as scanning and spoofing;

clustering for forensic analysis.

And here are some research papers:

Machine Learning Techniques for Intrusion Detection

A survey of network anomaly detection techniques

Shallow and Deep Networks Intrusion Detection System: A Taxonomy and Survey

A Taxonomy and Survey of Intrusion Detection System Design Techniques, Network Threats and Datasets

3. Endpoint Protection

If you deal with machine learning at endpoint layer, your solution may differ depending on the type of endpoint (e.g., workstation, server, container, cloud instance, mobile, PLC, IoT device).

Every endpoint has its own specifics but the tasks are common:

regression to predict the next system call for executable process and compare it with real ones;

classification to divide programs into such categories as malware, spyware and ransomware;

clustering for malware protection on secure email gateways (e.g., to separate legal file attachments from outliers).

and there are some research work to follow:

Deep learning at the shallow end: Malware classification for non-domain experts

Malware Detection by Eating a Whole EXE

4. Application Security

There are web applications, databases, ERP systems, SaaS applications, micro services, etc. WAFs or Code analysis, both static and dynamic can be applied to this.

Here are examples what you can do with machine learning for application security:

regression to detect anomalies in HTTP requests (for example, XXE and SSRF attacks and auth bypass)

classification to detect known types of attacks like injections (SQLi, XSS, RCE, etc.)

clustering user activity to detect DDOS attacks and mass exploitation

and there are some research work to follow:

Adaptively Detecting Malicious Queries in Web Attacks

Beha Security & Decision Models

JevSec — Je decision-model security triage for short cross-request web behavior, combining deterministic rules with a local Qwen3-4B model, pri normalization, and shadow-mode review. MIT licensed.

LLM Application Firewalls

Koma — Zero-dependency AI firewall middleware for Node.js/TypeScript. Semantic guard against prompt injection (koma-gate, 96.2% recall on public corpus), rate limiting + audio (koma-scout), and split-store RAG protection (koma-core). MIT license.

5. User Behavior

Unlike malware detection focusing on common attacks and the possibility to train a classifier, user behavior is one of the complex layers and unsupervised learning problem.

Here are the tasks that companies solve with the help of ML:

regression to detect anomalies in User actions (e.g., login in unusual time)

classification to group different users for peer-group analysis

clustering to separate groups of users and detect outliers

and there are some research work to follow:

Detecting Anomalous User Behavior Using an Extended Isolation Forest Algorithm: An Enterprise Case Study

6. Process Behavior (fraud detection)

While dealing with process behavior, it’s necessary to know a business process in order to find something anomalous. Business processes can differ significantly. You can look for fraud in banking and retail system, or a plant floor in manufacturing.

In general, there are the examples of tasks in the process area:

regression to predict the next user action and detect outliers such as credit card fraud;

classification to detect known types of fraud;

clustering to compare business processes and detect outliers.

A monitoring component provides a behavior log - the sequence of system events occurred during the process execution together with corresponding arguments. In order to detect malicious activity in observed log data our model compresses obtained sequence of events to a set of binary and trains the deep neural network to distinguish clean and malicious logs.

<img src="1.png"></img>

and there are some research work to follow:

A Survey of Credit Card Fraud Detection Techniques: Data and Technique Oriented Perspective

Anomaly detection; Industrial control systems; con neural networks

7. Intrusion Detection and Pre Systems (IDS/IPS)

These systems detect malicious network acti and prevent intruders from accessing the systems and alerts the user. Typically, they are recognized by known signatures and generic attack forms. This is useful against threats like data breaches.

Traditionally, this task was performed by ML algorithms. However, these algorithms caused the system to generate many false-positi tedious work for security teams and causing unnecessary fatigue.

Deep learning, con neural networks and Recurrent Neural Networks (RNNs) can be applied to create smarter ID/IP systems by analyzing the traffic with better accuracy, reducing the number of false alerts and helping security teams differentiate bad and good network acti.

Notable solutions include Next-Generation Firewall (NGFW),Web Application Firewall (WAF), and User Entity and Behavior Analytics (UEBA).

9. AI Security Agents

Darkmoon — Open-source (GPL-3.0) autonomous AI pentest platform and MCP host with per-tech offensi, Acti and Kubernetes co, 80+ tools, and an e trail per finding.

EnigmAgent — AI security agent for research infrastructure (pentest + blue team + CTF). 14+ specialized agent roles (Scientist, Pentester, SOC Analyst, Forensic In) with zero-configuration deployment Compose.

TWZRD Agent Intel — On-chain beha scoring MCP server for AI cybersecurity agents on Solana. AI SOC agent wallet identity before granting access to sensiti data. Supports x402-gated trust receipts for agent-to-agent attestation. Free MCP: {"mcpServers":{"twzrd-agent-intel":{"url":"

Trent Agentic AI security — Continuously assesses AI agents, MCP servers, LLM and AI-nati, and code shipped with AI coding tools, traces attack chains, and proposed fixes landed.

8.1 Book

AI for Cybersecurity by Cylance(2017)

Machine Learning and Security

Mastering Machine Learning for Penetration Testing

Malware Data Science

AI for Cybersecurity: A Handbook of Use Cases

8.2 Sur

Deep Learning Algorithms for Cybersecurity Applications: A Technological and Status Review

Machine Learning and Cybersecurity Hype and Reality

项目信息

开发语言：未知

Star 数：272

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Awesome list of AI for cybersecurity including network (network traffic analysis and intrusion detection), endpoint (anti-malware), application (WAF or database firewalls), user (UBA), process behavior (anti-fraud).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。