{"id":13601554,"url":"https://github.com/ysrc/yulong-hids-archived","last_synced_at":"2026-01-14T22:58:05.225Z","repository":{"id":45720941,"uuid":"117965276","full_name":"ysrc/yulong-hids-archived","owner":"ysrc","description":"[archived] 一款实验性质的主机入侵检测系统","archived":true,"fork":false,"pushed_at":"2020-06-29T15:38:38.000Z","size":9851,"stargazers_count":2187,"open_issues_count":43,"forks_count":585,"subscribers_count":88,"default_branch":"master","last_synced_at":"2026-01-12T02:43:52.450Z","etag":null,"topics":["hids","intrusion-detection"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ysrc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-01-18T10:02:46.000Z","updated_at":"2026-01-01T04:04:53.000Z","dependencies_parsed_at":"2022-08-27T07:12:34.447Z","dependency_job_id":null,"html_url":"https://github.com/ysrc/yulong-hids-archived","commit_stats":null,"previous_names":["ysrc/yulong-hids"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/ysrc/yulong-hids-archived","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysrc%2Fyulong-hids-archived","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysrc%2Fyulong-hids-archived/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysrc%2Fyulong-hids-archived/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysrc%2Fyulong-hids-archived/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ysrc","download_url":"https://codeload.github.com/ysrc/yulong-hids-archived/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ysrc%2Fyulong-hids-archived/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28437643,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T22:37:52.437Z","status":"ssl_error","status_checked_at":"2026-01-14T22:37:31.496Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hids","intrusion-detection"],"created_at":"2024-08-01T18:01:04.430Z","updated_at":"2026-01-14T22:58:04.843Z","avatar_url":"https://github.com/ysrc.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# 驭龙 HIDS \n\n\n[![License](https://img.shields.io/badge/License-GPL%20v2-blue.svg?style=flat-square)](https://github.com/ysrc/yulong-hids/blob/master/LICENSE)\n[![Golang](https://img.shields.io/badge/Golang-1.9-yellow.svg?style=flat-square)](https://www.golang.org/) [![Mongodb](https://img.shields.io/badge/MongoDB-3.4-red.svg?style=flat-square)](https://www.mongodb.com/download-center?jmp=nav) [![elasticsearch](https://img.shields.io/badge/Elasticsearch-5.6.4-green.svg?style=flat-square)](https://www.elastic.co/downloads/elasticsearch)\n\n`由于此项目缺少维护，建议仅用于参考学习和二次开发`\n\n**驭龙HIDS**是一款由 YSRC 开源的入侵检测系统，由 `Agent`， `Daemon`， `Server` 和 `Web` 四个部分组成，集异常检测、监控管理为一体，拥有异常行为发现、快速阻断、高级分析等功能，可从多个维度行为信息中发现入侵行为。\n\n**Agent**为采集者角色，收集服务器信息、开机启动项、计划任务、监听端口、服务、登录日志、用户列表，实时监控文件操作行为、网络连接、执行命令，初步筛选整理后通过RPC协议传输到Server节点。\n\n**Daemon**为守护服务进程，为Agent提供进程守护、静默环境部署作用，其任务执行功能通过接收服务端的指令实现Agent热更新、阻断功能和自定义命令执行等，任务传输过程使用RSA进行加密。\n\n**Server**为整套系统的大脑，支持横向扩展分布式部署，解析用户定义的规则（已内置部分基础规则）对从各Agent接收到的信息和行为进行分析检测和保存，可从各个维度的信息中发现webshell写入行为、异常登录行为、异常网络连接行为、异常命令调用行为等，从而实现对入侵行为实时预警。\n\n## 文档\n\n* [部署文档](./docs/install.md)\n* [Docker快速体验部署文档](./docs/docker.md)\n* [使用帮助](./docs/help.md)\n* [规则编写](./docs/rule.md)\n* [编译指南](./docs/build.md)\n* [Web安装向导指南](./docs/guide.md)\n* [Q\u0026A](./qa.md)\n\n## 功能特点\n\n- 实时监控、秒级响应\n- 全局首次出现概念，可发现未知威胁\n- 支持自定义规则，高扩展性\n- 高级分析功能，可溯源\n- 全局快速阻断（进程、文件）\n- 威胁情报查询（可自定义接口）\n\n\n\u003e 相比其他同类应用，维护使用此系统需要有一定的安全判断分析能力。\n\n\n## 整体架构图\n\n![](./docs/jg.png)\n\n## 测试效果图\n\n![](./docs/yulong.gif)\n\n\n## TODO\n- 建立入侵行为case库，自动化重放case模拟测试\n- 机器学习判断可疑行为，作为规则之外的补充\n- 资产盘点，例如识别补丁，应用版本、负责人，各种包/kernel版本...\n- 辅以漏洞库，能更快速的应急响应，哪些必须要修，那些不修可以接受\n- 区分通讯模式（主动、被动）\n- 使用消息队列代替RPC\n- 基线核查，没有代码能力的社区成员也可以整理好相关文档，YSRC来实现\n- 幻影蜜罐，agent动态代理蜜罐端口，大规模提升蜜罐覆盖密度\n- 支持多场景（办公环境、Docker），目前驭龙仅适合线上服务器环境\n- 轻量级的linux内核防护，在不升级内核的情况下，免疫一些攻击\n\n## 源码结构\n```\n├─agent // Agent工程\n│  ├─client // RPC client 传输模块\n│  ├─common\n│  ├─collect // 信息收集（开机启动项、计划任务、监听端口、服务、登录日志、用户列表）\n│  └─monitor // 行为监控（文件操作、网络连接、执行命令）\n├─bin\n│  ├─linux-64 // Linux 64位的依赖包\n│  ├─win-32 // Windows 32位的依赖包\n│  └─win-64 // Windows 64位的依赖包\n├─daemon // Daemon工程\n│  ├─common\n│  ├─install // 安装Agent和相关依赖\n│  └─task // 任务接收\n├─docs // 说明文档\n├─driver // Windows 命令监控驱动\n├─server // Server节点工程\n│  ├─action // Server基本功能\n│  ├─models // 数据库相关\n│  └─safecheck // 安全检测模块（黑白名单，规则解析引擎）\n├─syscall_hook # 监控执行命令的Linux内核代码\n│  └─test_bench // 方便调试的\n└─web // Web控制台项目\n    ├─conf // web端配置文件\n    ├─controllers // 控制器，负责转发请求，对请求进行处理\n    ├─httpscert // https证书和RSA私钥，内置的会在向导过程中自动更新\n    ├─models // 模型，数据管理和数据库设计\n    ├─routers // 路由\n    ├─settings // 部分全局变量\n    ├─static // 静态文件\n    ├─upload_files // agent、daemon、依赖包文件\n    ├─utils // 功能模块\n    └─views // 视图层，前端模板\n```\n\n## 参与者及致谢\n\n致谢列表：[Contributors List](./contributors.md)\n\n## 关于\n\n本项目经过 YSRC 测试和部署，但由于企业网络架构与部署环境之间的差异，我们无法保证本项目在贵司环境中的稳定性及有效性。\n使用前请先自行测试和改动，对应用本系统可能导致的损失 YSRC 所属组织及公司概不负责。\n\n扫描下方二维码关注 YSRC 公众号，回复 驭龙 ，会有人拉你进驭龙的微信讨论群。\n\n\n![](./docs/ysrc.png)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fysrc%2Fyulong-hids-archived","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fysrc%2Fyulong-hids-archived","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fysrc%2Fyulong-hids-archived/lists"}