ai_for_the_win - 构建人工智能驱动的安全工具。50多个动手实验室 - 剑庭安 - 网站开发定制 SEO 优化蜘蛛池代做在线看手相算命

ai_for_the_win - Build AI-powered security tools. 50+ hands-on labs

项目说明

AI for the Win

Build AI-Powered Security Tools | Hands-On Learning

![CI]()
![OpenSSF Scorecard]()
![Python 3.10-3.12]()
![License: Dual-blue.svg)](./LICENSE)
![Open In Colab]()
![Docker](./Dockerfile)

A hands-on training program for security practitioners who want to build AI-powered tools for threat detection, incident response, and security automation. 50+ labs (including 9 intro labs and 12 bridge labs), 4 capstone projects, 18 CTF challenges. Includes sample datasets, solution walkthroughs, and Docker lab en. Designed for vibe coding with AI assistants like Cursor, Claude Code, and Copilot.

---

What You'll Build

Lab 10 - Phishing Classifier catches what rules miss:

Lab 35 - LLM Log Analysis finds attacks in noise:

---

Start in 60 Seconds

No installation needed -- click and run in your browser:

Beginner (No API key):

![Lab 02]() Prompt Engineering basics

![Lab 07]() Your first ML model

Intermediate (No API key):

![Lab 10]() ML phishing detection

Ad (API key required):

![Lab 15]() LLM-powered log analysis

> All 50+ notebooks are in notebooks/ -- open any .ipynb in Colab

---

Pick Your Starting Point

| Your Background | Start Here | Next Steps |
|-----------------|------------|------------|
| Completely new to AI? | Lab 02: Prompt Engineering | -> Lab 07 -> Lab 10 |
| New to AI/ML? | Lab 10: Phishing Classifier | -> Lab 11 -> Lab 12 |
| Know Python, want LLM tools? | Lab 15: LLM Log Analysis | -> Lab 16 -> Lab 18 |
| Want DFIR focus? | Lab 31: Ransomware Detection | -> Lab 33 -> Lab 34 |

Tip: Labs 00-13 are FREE (no API keys). LLM labs (14+) need an API key (~$5-25 total).

---

Lab Na

Click any lab to explore -- Your learning journey from setup to expert:

Legend: Grey Foundation (00-09, Free) | Green ML Foundations (10-13, Free) | Purple LLM Basics (14-18) | Orange Detection/DFIR (19-29) | Red Ad/Cloud (30-50)

<details>
<summary>Detailed Lab Descriptions</summary>

Foundation Labs (00-09) -- Setup & Foundations, no API keys

| Lab | Topic | Description |
|-----|-------|-------------|
| 00 | Setup | En configuration |
| 01 | Python | Security-focused Python basics |
| 02 | Prompts | LLM basics with free playgrounds |
| 03 | Vibe Coding | AI assistants for accelerated learning |
| 04 | ML Intro | Supervised/unsupervised, features, e |
| 05 | AI in SOC | Where AI fits, human-in-the-loop |
| 06 | Stats | Matplotlib, Seaborn for dashboards |
| 07 | Hello ML | Your first ML model end-to-end |
| 08 | APIs | REST APIs, authentication, rate limiting |
| 09 | CTF Fundamentals | CTF mindset, encoding, flag hunting |

ML Labs (10-13) -- Machine Learning, no API keys

| Lab | Topic | Description |
|-----|-------|-------------|
| 10 | Phishing | TF-IDF, Random Forest, classification |
| 11 | Malware | K-Means, DBSCAN, clustering binaries |
| 12 | Anomaly | Isolation Forest, LOF, baselines |
| 13 | ML vs LLM | When to use each, cost tradeoffs |

LLM Labs (14-18) -- Language Models & Agents

| Lab | Topic | Description |
|-----|-------|-------------|
| 14 | Agent | ReAct pattern, tool calling basics |
| 15 | Logs | Prompt engineering, IOC extraction |
| 16 | Intel | LangChain, autonomous in |
| 17 | | Embeddings, similarity search |
| 18 | RAG | ChromaDB, retrie Q&A |

Detection & DFIR Labs (19-35) -- Pipelines, Automation & Forensics

| Lab | Topic | Description |
|-----|-------|-------------|
| 19 | Binary | PE structure, entropy analysis |
| 20 | Sigma | Log-based detection rules |
| 21 | YARA | AI-assisted rule generation |
| 22 | Vuln | CVSS, risk prioritization |
| 23 | Pipeline | ML filtering + LLM enrichment |
| 24 | Monitor | Obser, cost tracking |
| 25 | DFIR | Forensics basics, e collection |
| 26 | Windows Logs | Event log parsing, detection |
| 27 | Registry | Registry forensics, persistence |
| 28 | Live IR | Li, triage procedures |
| 29 | IR Bot | Con IR, playbook execution |
| 30 | Ransom Fund | Ransomware families, attack lifecycle |
| 31 | Ransom | Entropy, beha detection |
| 32 | Purple | Safe ad emulation |
| 33 | Memory | , process injection |
| 34 | C2 | Beaconing, DNS tunneling, JA3 |
| 35 | Lateral | Auth anomalies, graph paths |

Expert Labs (36-50) -- Ad, Cloud & Ad

| Lab | Topic | Description |
|-----|-------|-------------|
| 36 | Actors | TTP extraction, attribution |
| 37 | AI Threat | Deepfakes, AI-generated phishing |
| 38 | MLSec | Data poisoning, model security |
| 39 | Adv ML | E attacks, robust defenses |
| 40 | LLM Security | Prompt injection testing, jailbreaks |
| 41 | Model Monitor | Drift detection, ad inputs |
| 42 | Tuning | LoRA, custom embeddings |
| 43 | RAG Security | KB poisoning, context sanitization |
| 44 | Cloud Fund | Shared responsibility, IAM |
| 45 | Cloud | AWS/Azure/GCP, CloudTrail |
| 46 | Container | Kubernetes, runtime detection |
| 47 | Ser | Lambda, event injection |
| 48 | Cloud IR | Automated containment, e |
| 49 | Red Team | Prompt injection, jailbreaks |
| 50 | Purple AI | Automated attack simulation |

</details>

---

Capstone Projects

| Project | Difficulty | Focus |
|---------|------------|-------|
| Security Analyst Copilot | Ad | LLM agents, IR automation |
| Automated Threat Hunter | Ad | ML detection, pipelines |
| Malware Analysis Assistant | Intermediate | Static analysis, YARA |
| Intel Platform | Intermediate | RAG, prioritization |

Each includes starter code, requirements, and e criteria. See capstone-projects/.

---

Local Setup

System Requirements

| Requirement | Minimum | Recommended |
|-------------|---------|-------------|
| Python | 3.10 | 3.10-3.12 (PyTorch not yet a for 3.13+) |
| RAM | 8GB | 16GB (for local LLMs) |
| OS | Windows, macOS, Linux | Any |
| Editor | Any | VS Code, Cursor, PyCharm |
| Git | Required | - |
| Docker | Optional | For containerized labs |
| API Key | Labs 14+ only | Free tiers a |

Option 1: Docker (Easiest!)

A services: Jupyter Lab, Elasticsearch, Kibana, PostgreSQL, Redis, MinIO, Ollama (local LLMs), ChromaDB (). Start only what you need — see docker/README.md for service profiles.

Option 2: Local Python Installation

> Python 3.10, 3.11, or 3.12 required. Python 3.13 is experimental. Python 3.14 is not supported — it causes resolution-too-deep errors because PyTorch, LangChain, and other packages lack 3.14 wheels. Check with python -- before proceeding.

<details>
<summary>Dependency install failing?</summary>

If pip install hangs or fails with resolution-too-deep:

1. Check Python — must be 3.10-3.12 (python --)
2. Try uv (faster resolver): pip install uv && uv pip install -r requirements.txt
3. Install selectively: pip install -e ".[anthropic]" instead of the full requirements.txt

See Troubleshooting Guide for details.

</details>

API Keys (for Labs 14+)

| | Description | Required |
|----------|-------------|----------|
| ANTHROPIC_API_KEY | Claude API | One LLM key required |
| OPENAI_API_KEY | GPT-4/5 API | One LLM key required |
| GOOGLE_API_KEY | Gemini API | One LLM key required |
| | | Optional |

> You only need ONE LLM provider. All labs support multiple pro.

Running Tests

---

Resources

| Resource | Description |
|----------|-------------|
| En Setup | First-time setup |
| AI for Security Leaders | Exec/manager guide: invest, measure, govern AI |
| API Keys Guide | Get API keys, manage costs |
| Troubleshooting | Fix common issues |
| Lab Walkthroughs | Step-by-step solutions |
| Role-Based Paths | SOC, IR, hunting paths |
| Security-to-AI Glossary | AI terms for security folks |
| All Guides | 28 guides: tools, APIs, ad |

Issues? Open a GitHub issue

Technology Stack

| Category | Tools |
|----------|-------|
| LLM Pro | Claude (Sonnet/Opus/Haiku), GPT-5, Gemini 3, Ollama |
| LLM Frameworks | LangChain, LangGraph, LiteLLM |
| ML/AI | scikit-learn, PyTorch, Transformers |
| DB | ChromaDB, sentence-transformers |
| Security | YARA, Sigma, MITRE ATT&CK, pefile |
| Vibe Coding | Cursor, Claude Code, Copilot, Windsurf |

---

Author

Created by Raymond DePalma

![LinkedIn]()

---

Contributing

Contributions welcome! Please read CONTRIBUTING.md first.

---

License

AI for the Win is dual-licensed for maximum flexibility:

| Content Type | License | Personal Use | Commercial Use |
|--------------|---------|--------------|----------------|
| Educational content, labs, docs | CC BY-NC-SA 4.0 | ✅ FREE | Requires license |
| Code samples and scripts | MIT | ✅ FREE | ✅ FREE |

Personal Use (FREE)

Indi learning and skill de

Academic coursework (as a student)

Personal portfolio projects

Contributing back to this project

Commercial Use (License Required)

Need a license for:

Corporate training programs (internal employee training)

Bootcamps & courses (paid training programs)

Consulting engagements using materials

Uni (formal curricula - FREE with attribution)

View Commercial Licensing Options | Contact Raymond DePalma

---

Trademark Notice

"AI for the Win" is a trademark of Raymond DePalma. You may reference this project by name with attribution, but may not use it in competing training programs or in ways that suggest official affiliation.

See LICENSE for complete terms.

---

Troubleshooting

Antivirus Blocking Sample Files

Some labs and CTF challenges include sample malware metadata, IOC patterns, or simulated attack artifacts that may trigger antivirus software. These files contain analysis data for educational purposes, not actual malware.

Paths to exclude in your antivirus software:

ai_for_the_win/ - The entire repository (recommended)

ctf-challenges/**/challenge/ - CTF challenge files with simulated web shells, persistence mechanisms

labs/lab21-yara-generator/data/ - Malware metadata for YARA rule generation

data/malware/ - Sample malware analysis artifacts

Add folder exclusions for these paths in your A if files are being quarantined.

Accessibility

This project aims to be accessible to all learners:

Lab difficulty indicators use both color AND text labels (e.g., "Beginner")

All code examples include descripti

Documentation uses high-contrast text

If you encounter accessibility issues, please open an issue.

---

Disclaimer

> Responsible Use: This material is for defensi education only. Do not use techniques described here for unauthorized access or attacks. See RESPONSIBLE_USE.md.

> This is a personal educational project created and maintained on personal time. It is not affiliated with, endorsed by, or sponsored by any employer, organization, or .

---

Ready to build AI-powered security tools? 
<a href=" in Colab</a> |
<a href="./labs/lab00-en/">Local Setup</a> |
<a href="./docs/ai-security-training-program.md">Full Curriculum</a>

项目信息

开发语言：Python

Star 数：163

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Build AI-powered security tools. 50+ hands-on labs covering ML, LLMs, RAG, threat detection, DFIR, and red teaming. Includes Colab notebooks, Docker environment, and CTF challenges.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	ai_for_the_win - 构建人工智能驱动的安全工具。50多个动手实验室
所属分类	CTF思路
发布作者	admin
发布时间	2026-10-05 23:48:40
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	356
讨论数量	0
主题状态	正常讨论中

ai_for_the_win - 构建人工智能驱动的安全工具。50多个动手实验室