AAFID (Autonomous Agents for Intrusion Detection) is a distributed monitoring architecture with an orientation towards Intrusion Detection developed at the CERIAS at Purdue University. AAFID2 is a prototype implementation of the architecture that includes several ready-to-work agents, plus development facilities for writing your own.
AIDE (Advanced Intrusion Detection Environment) is a file and directory integrity checker. It creates a database from the regular expression rules that it finds from the config file. Once this database is initialized it can be used to verify the integrity of the files. Several message digest algorithms are used. All of the usual file attributes can also be checked for inconsistencies.
AMaViS (A Mail Virus Scanner) scans e-mail attachments for viruses using third-party virus scanners available for UNIX environments. It resides on a UNIX (Linux) machine and looks through the attached files arriving via e-mail, generates reports when a virus is found and sets the delivery on hold.
Angst is an active sniffer, based on libpcap and libnet. It dumps into a file the payload of all the TCP packets received on the specified ports. It implements two methods for active sniffing. Angst is able to monitor ARP requests, and after enabling IP forwarding on the local host, it sends ARP replies mapping all IPs to the local MAC address. Also, it can flood the local network with random MAC addresses (like macof), causing switches to send packets to all ports.
arc is an ASN.1 compiler written by FORGE Research for use in internal projects. It is being released under a BSD-like licence. arc creates Java source code that uses the basic ASN.1 classes that were created for use with other FORGE projects. These basic ASN.1 classes are included in the arc distribution.
Astaro Portscan Detection is a netfilter target which will attempt to detect TCP and UDP port scans and log them to syslog. This target is based upon Solar Designer's scanlogd. It suppports mutliple levels of logging, custom prefixes for entries, weighted total port scan detection, and port scan temporal spread detection.