Slips v1.1.18 by AlyaGomaa · Pull Request #1833 · stratosphereips/StratosphereLinuxIPS

AlyaGomaa · 2026-03-03T18:17:45Z

Add the HTTPS anomaly detection module with adaptive baselines, confidence scoring, and detailed evidence reasons.
Enable ADWIN drift detection by default for HTTPS anomaly detection, with separate hourly and flow drift paths.
Add a local HTML report generator for HTTPS anomaly detection logs, with interactive charts and anomaly summaries.
Improve performance under high-throughput traffic and reduced OOM risk.
Improve Redis memory hygiene with tighter TTLs, capped zsets, periodic cleanups.
Improve the speed of HTTP Analayzer module.

…nf to .git by accident

…reset by peer"

…e operations

… in AMD to be able to use activedefrag

…-2 only.

…n ever growing list of blocked ips in redis

…n module

…anagement

… HTTPS anomaly detection

…TPS anomaly detection logs

…optional timestamps and improved HTML output

…dule, including hourly plots and model adaptation markers

…alls module-specific shutdown_gracefully()

…long as the workers are up.

…er_queue

…e profiler queue for each worker to stop.

…n shutdown_gracefully()

… the rest stopping logic

…ne with shutdown_gracefully

…stopping

…l it from pre_main instead of init() to ensure subscription to pub/sub channels is not inherited from the parent

…mon _pre_main that calls module-specific pre_main()

… on the default redis port

…cal paths

…j is determined to be able to pass it to new workers

…oom_killed Better handling of how slips stops and improve in memory storage of flows (Fix slips getting OOM killed)

AlyaGomaa and others added 30 commits February 13, 2026 13:56

ssh: fix setting "SSH password guessing" evidence

6eb5c17

don't check the existence of redis db before setting up the output dir

7c9b083

redis: enable port specific log files in slips output dir

3f2e692

redis_manager: use RedisDB class for checking and starting the cache db

26cbf7a

add a config/redis.conf.template to avoid pushing the user's redis.co…

533ed5a

…nf to .git by accident

redis: add socket_connect_timeout=5 when starting redis to fix "conn …

85ab518

…reset by peer"

redis: ping every 5s

db93b4e

log rchache and r connection stats every 5s (for debugging)

edddc63

redis: use threads for read operations, and 4 cores for threaded writ…

322bb76

…e operations

redis: set maxmemory to 3gb and maxmemory-policy to allkeys-lru

45b568c

docker: when building redis, use MALLOC=libc in ARM arch and jemalloc…

f1d6d36

… in AMD to be able to use activedefrag

enable activedefrag in redis.conf.template

beeb97d

dockerfile: fix trailing \

405ebc9

dockerfile: change workdir to slips dir

d3808cb

redis_manager.py: add missing import

7e30dbb

db: be smarter when deleting old tws, don't loop, del the closed one …

dbe0f59

…-2 only.

db: delete unused key {attacker}_evidence_summary

5c25686

fetch the blocked IPs from sqlite instead of redis to avoid storing a…

ebe38ef

…n ever growing list of blocked ips in redis

remove all usages of MALICIOUS_PROFILES db const

f23303a

expire FLOWS_CAUSING_EVIDENCE after 2 tws

ba7663f

feat: add anomaly detection configuration for HTTPS traffic

5f48aff

feat: add HTTPS anomaly detection configuration parameters

33f96d2

feat: implement HTTPS anomaly detection module with adaptive baselines

c74f0f0

feat: add license and copyright information to HTTPS anomaly detectio…

e7f6a79

…n module

feat: add comprehensive README for HTTPS anomaly detection module

3271eec

feat: enhance anomaly detection with confidence scoring and history m…

d404d05

…anagement

feat: update README to clarify data source and processing details for…

a7bc8cc

… HTTPS anomaly detection

feat: implement analyze_ad_log.py for generating HTML reports from HT…

b3dc381

…TPS anomaly detection logs

feat: enhance event handling and reporting in analyze_ad_log.py with …

ead44f4

…optional timestamps and improved HTML output

feat: add detailed output features to README for anomaly detection mo…

10ef73d

…dule, including hourly plots and model adaptation markers

AlyaGomaa added 26 commits February 27, 2026 23:46

iasyncmodule: unsubscribe from all channels on shutdown

4ea6e96

imodule: have a common _shutdown_gracefully() for all modules, that c…

f644692

…alls module-specific shutdown_gracefully()

profiler: move the monitoring log to its own thread that stays up as …

2c9232d

…long as the workers are up.

profiler workers: only die when no more flows are there in the profil…

350d93b

…er_queue

profiler: keep track of the number of started workers in the db

4b6de70

input: put num_of_started_profiler_workers sentinel stop values in th…

2f8a2de

…e profiler queue for each worker to stop.

profiler: start all workers, then immediately wait for them to stop i…

017095f

…n shutdown_gracefully()

icore: lazily set next_fps_check_time if not set

71a7840

worker: make the only signalf or workers to stop is the stop msg, del…

a806cdf

… the rest stopping logic

iasync_module: unsubscribe from redis channels after the module is do…

6a03379

…ne with shutdown_gracefully

evidence: wait 30s instead of 1min for new evidence to arrive before …

33cfece

…stopping

Add a subscribe_to_channels() function in every single module and cal…

51e5b49

…l it from pre_main instead of init() to ensure subscription to pub/sub channels is not inherited from the parent

imodule: make subscribe_to_channels() an abstractmethod and add a com…

a61f207

…mon _pre_main that calls module-specific pre_main()

add subscribe_to_channels() to ICore classes

2f286fc

add subscribe_to_channels() to profiler worker

083bbe1

Fix not being able to flush the db when starting a new slips instance…

6190aaf

… on the default redis port

delete redis.conf from git to avoid accidentally commiting it with lo…

5b8d1ba

…cal paths

input classes: fix duplicate calls to mark_self_as_done_processing()

ac84e16

make sure that input is done before running the profiler's shutdown func

ca50af2

profiler: start the profiler monitor loop only after input_handler_ob…

f60961f

…j is determined to be able to pass it to new workers

update unit tests

2c41a98

Merge pull request #1828 from stratosphereips/alya/fix_slips_getting_…

78541d1

…oom_killed Better handling of how slips stops and improve in memory storage of flows (Fix slips getting OOM killed)

update docs, changelog and README

117ad30

del redis.conf from git to avoid committing local paths by accident

6f6d1b6

Merge remote-tracking branch 'origin/develop' into develop

89ae37f

bump slips version to 1.1.18

49a1c15

github-project-automation bot added this to Slips Mar 3, 2026

github-project-automation bot moved this to Todo in Slips Mar 3, 2026

AlyaGomaa merged commit 56da56c into master Mar 3, 2026
90 checks passed

github-project-automation bot moved this from Todo to Done in Slips Mar 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Slips v1.1.18#1833

Slips v1.1.18#1833
AlyaGomaa merged 319 commits intomasterfrom
develop

AlyaGomaa commented Mar 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

AlyaGomaa commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AlyaGomaa commented Mar 3, 2026 •

edited

Loading